[UNIX] Konqueror DoS via JavaScript Read of FTP iframe

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Konqueror DoS via JavaScript Read of FTP iframe
------------------------------------------------------------------------


SUMMARY

Konqueror crashes if JavaScript code tries to read the source of a child
iframe which is set to an ftp:// URL. It is possible for malicious
websites to crash Konqueror and possibly other applications with rely on
KJS.

DETAILS

Vulnerable Systems:
* Gentoo and Debian running KDE 3.5.5.

The KDE JavaScript implementation, KJS has been found to crash when it
tries to read the contents of an FTP iframe. This can be demonstrated by
creating a web page with an iframe with a src of
"ftp://localhost/anything";, then reading the contents of this iframe with
JavaScript similar to the following. (A working FTP server is not
required).

var contents =
document.getElementById(iframe_name).contentWindow.document.body.innerHTML;

Disclosure Timeline:
* 2007-02-03 - Vulnerability reported to security@xxxxxxx
* 2007-02-28 - KDE team recreate bug and produce preliminary patch for
nodes.cpp
* 2007-03-01 - KDE team produced updated patch for ecma/kjs_html.cpp
* 2007-03-04 - Public advisory released

Patch Information:
The latest patch received from the KDE team is available from:
<http://bindshell.net/advisories/konq355/konq355-patch.diff>
http://bindshell.net/advisories/konq355/konq355-patch.diff

Proof of concept:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<html>
<head>
<title>BindShell.Net: Konqueror DoS Via JavaScript Read Of FTP
Iframe</title>
<link rel="pingback" href="http://www.bindshell.net/pingback"; />
<link rel="style***" type="text/css" media="all"
href="/style/default.css" />
<meta name="keywords" content="konqueror dos crash denial service
segfault ftp iframe" />
</head>
<body>

<div id="banner">
<a href="/"><img src="/image/logo.gif"></a>
</div>

<div id="breadcrumbs">
<a href="/">Home</a> : <a href="/advisories">Advisories</a> : Konqueror
DoS Via JavaScript Read Of FTP Iframe
</div>
<div id="main">
<div id="sidebar">
<div class="section">
<p class="title">Index</p>
<ul>
<li><a href="/advisories">Advisories</a></li>
<li><a href="/exploits">Exploits</a></li>
<li><a href="/papers">Papers</a></li>
<li><a href="/tools">Tools</a></li>
</ul>
<p class="title">Users</p>
<ul>
<li><a href="/users/Dave">Dave</a></li>
<li><a href="/users/John">John</a></li>
<li><a href="/users/Wade">Wade</a></li>
</ul>
<p class="title">Categories</p>
<ul>
<li><a href="/archive/news">Site News</a> (9)</li>
<li><a href="/archive/rants">Rants</a> (1)</li>
<li><a href="/archive/security">Security</a> (5)</li>
<li><a href="/archive/technology">Technology</a> (5)</li>
</ul>
<p class="title">Archive</p>
<ul>
<li><a href="/archive/2007/January ">January </a> (1)</li>
<li><a href="/archive/2006/December ">December </a> (1)</li>
<li><a href="/archive/2006/November ">November </a> (3)</li>
<li><a href="/archive/2006/October ">October </a> (1)</li>
<li><a href="/archive/2006/September">September</a> (1)</li>
<li><a href="/archive/2006/August ">August </a> (2)</li>
<li><a href="/archive/2006/July ">July </a> (3)</li>
<li><a href="/archive/2006/June ">June </a> (1)</li>
<li><a href="/archive/2006/May ">May </a> (2)</li>
<li><a href="/archive/2006/April ">April </a> (2)</li>
<li><a href="/archive/2006/March ">March </a> (2)</li>
<li><a href="/archive/2006/February ">February </a> (1)</li>
</ul>

</div>
<div class="footer">[ <a href="https://bindshell.net/login";>Login</a>
]</div>
</div>
<div id="pagecontent">
<div id="toc"><strong>Contents</strong>
<div style="margin-left: 0em;"><a href="#toc1">Summary</a></div>
<div style="margin-left: 0em;"><a href="#toc2">Impact</a></div>
<div style="margin-left: 0em;"><a href="#toc3">Details</a></div>
<div style="margin-left: 0em;"><a href="#toc4">Exploit</a></div>
<div style="margin-left: 0em;"><a href="#toc5">Vulnerable
Versions</a></div>
<div style="margin-left: 0em;"><a href="#toc6">Disclosure
Timeline</a></div>
<div style="margin-left: 0em;"><a href="#toc7">Patch
Information</a></div>
</div>


<h1 id="toc0">Konqueror DoS Via JavaScript Read Of FTP Iframe</h1>
<p><img src="/advisories/konq355/konqueror.jpg"
class="inline-left">Author: <a
href="mailto:mark@xxxxxxxxxxxxx";>mark@xxxxxxxxxxxxx</a><br />
Published: 4th March 2007</p>


<h2 id="toc1">Summary</h2>
<p>Konqueror crashes if JavaScript code tries to read the source of a
child iframe which is set to an FTP URL.</p>


<h2 id="toc2">Impact</h2>
<p>It is possible for malicious websites to crash Konqueror and possibly
other applications with rely on KJS.</p>


<h2 id="toc3">Details</h2>
<p>The KDE JavaScript implementation, KJS has been found to crash when it
tries to read the contents of an FTP iframe. This can be demonstrated by
creating a web page with an iframe with a src of "<a
href="ftp://localhost/anything"; onclick="window.open(this.href, '_self');
return false;">ftp://localhost/anything</a>", then reading the contents of
this iframe with JavaScript similar to the following. (A working FTP
server is not required).<br />

<pre><code>
document.getElementById(iframe_name).contentWindow.document.body.innerHTML;</code></pre>

</p>


<h2 id="toc4">Exploit</h2>
<p>Proof of concept code is available at:<br />
<a href="http://bindshell.net/advisories/konq355/konq355-crash-demo.zip";
onclick="window.open(this.href, '_self'); return
false;">http://bindshell.net/advisories/konq355/konq355-crash-demo.zip</a></p>


<h2 id="toc5">Vulnerable Versions</h2>
<p>This vulnerability has been tested on Gentoo and Debian running KDE
3.5.5.</p>


<h2 id="toc6">Disclosure Timeline</h2>
<p>2007-02-03 Vulnerability reported to security@xxxxxxx<br />
2007-02-28 KDE team recreate bug and produce preliminary patch for
nodes.cpp<br />
2007-03-01 KDE team produced updated patch for ecma/kjs_html.cpp<br />
2007-03-04 Public advisory released</p>


<h2 id="toc7">Patch Information</h2>
<p>The latest patch received from the KDE team is available from:<br />
<a href="http://bindshell.net/advisories/konq355/konq355-patch.diff";
onclick="window.open(this.href, '_self'); return
false;">http://bindshell.net/advisories/konq355/konq355-patch.diff</a></p>

<p><div class="lastupdate">Last updated by Mark on 05-Mar-07 at
07:51am</div></p>

</div>
</div>

<a href="/login" accesskey="L" class="hidden"></a>
<!--
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#";
xmlns:dc="http://purl.org/dc/elements/1.1/";
xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/";>
<rdf:Description rdf:about="http://www.bindshell.net";
dc:identifier="http://www.bindshell.net";
dc:title="bindshell.net"
trackback:ping="http://bindshell.net/trackback"; />
</rdf:RDF>
-->
</body>
</html>


ADDITIONAL INFORMATION

The information has been provided by <mailto:mark@xxxxxxxxxxxxx> Mark.
The original article can be found at:
<http://bindshell.net/advisories/konq355>
http://bindshell.net/advisories/konq355



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages