[UNIX] Kmail (table/frameset) DoS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Kmail (table/frameset) DoS
------------------------------------------------------------------------


SUMMARY

"KMail is a fully-featured email client that fits nicely into the K
Desktop Environment, KDE. It has features such as support for IMAP, POP3,
multiple accounts, powerful filters, PGP/GnuPG privacy, inline
attachments, and much more."

Kmail can be crashed due to incorrectly parsing certain HTML elements.

DETAILS

Vulnerable Systems:
* KDE 3.5.2 and kmail 1.9.1 (tested on)

Background:
Kmail is a HTML compatible email client that comes installed by default
with the KDE desktop. This DOS requires HTML parsing to be enabled. This
can be done in Kmail by going to Settings -> Configure Kmail ->Security
-> and tick Prefer HTML to Plain Text.

Description:
Kmail can be crashed due to incorrectly parsing certain HTML elements. In
this case the a combination of the and tags are incorrectly parsed
leading to a segmentation fault. A sample mail can be found here
<http://silenthack.co.uk/nnp/exploits/kmail/tableCrash>
http://silenthack.co.uk/nnp/exploits/kmail/tableCrash.

To reproduce the crash, copy the above mail into your local mail spool
file (e.g /var/mail/`whoami`) or send it to yourself (without the email
headers obviously). Double click the new mail and when it opens close it
again. On closing it the program should crash and give the following stack
trace:

[KCrash handler]
#6 0xb790a334 in free () from /lib/tls/i686/cmov/libc.so.6
#7 0xb7aab8b1 in operator delete () from /usr/lib/libstdc++.so.6
#8 0xb7aab8fd in operator delete[] () from /usr/lib/libstdc++.so.6
#9 0xb6cd05d8 in non-virtual thunk to
DOM::HTMLObjectBaseElementImpl::~HTMLObjectBaseElementImpl() () from
/usr/lib/libkhtml.so.4
#10 0x084de030 in ?? ()
#11 0x084d03e8 in ?? ()
#12 0x00000001 in ?? ()
#13 0xb6e43aec in ?? () from /usr/lib/libkhtml.so.4
#14 0x084d03e8 in ?? ()
#15 0x00000000 in ?? ()


ADDITIONAL INFORMATION

The information has been provided by <mailto:version5@xxxxxxxxx> nnp.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Cross Application Scripting in Trend Micros Antivirus Software
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The SecuriTeam alerts list - Free, Accurate, Independent. ... When the product alerts the user of a possible virus, it creates an HTML ...
    (Securiteam)
  • [TOOL] kses, PHP Based HTML Filter
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... kses is an HTML/XHTML filter written in PHP. ... It removes all unwanted HTML ... * Attribute values can be surrounded with quotes, ...
    (Securiteam)
  • [UNIX] Kmail Table with Frameset DoS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Kmail Table with Frameset DoS ... Kmail is a HTML compatible email client that comes installed by default ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] HTMLer - An Automated Broken HTML Generator (Mangleme Python Port)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... It will create a plethora of broken HTML pages in a subdirectory under the ... It allows the crafter of the HTML to control EAX, ... def randstring: ...
    (Securiteam)
  • [UNIX] CuteNews HTML Injection Vulnerability Via Commentaries
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... HTML code can be injected via the commentaries feature of CuteNews. ...
    (Securiteam)