[Full-disclosure] Google Chrome Browser Vulnerability

[Chris Pritchard]

I don't think it's "your" list, and even if it was, you didn't have to be so 
rude about it

-----Original Message-----
From: full-disclosure-bounces at lists.grok.org.uk 
[mailto:full-disclosure-bounces at lists.grok.org.uk] On Behalf Of Fionnbharr
Sent: 04 September 2008 13:33
To: Juha-Matti Laurio
Cc: full-disclosure at lists.grok.org.uk; evil fingers
Subject: Re: [Full-disclosure] Google Chrome Browser Vulnerability

dear god people, I've got null ptr derefs in firefox but I don't make
full disclosure posts about them. I care about them nearly as much as
vulnz in a browser no one uses for more than 5 minutes. Get the fuck
off my list.

2008/9/4 Juha-Matti Laurio <juha-matti.laurio at netti.fi>:
> FYI:
> This was assigned to BID30983:
> http://www.securityfocus.com/bid/30983
>
> Juha-Matti
>
> Rishi Narang [psy.echo at gmail.com] wrote:
>> Hi,
>>
>> "Time" can definitely plays a major role.  There was a collision that 
>> occurred due to the fact that I took time to find the real break point in 
>> the code, search for a template and to publish at EvilFingers site before 
>> sending it to Google and other bugtraqs.
>>
>> Even though I had the vulnerability 4 hrs well before the real publication 
>> of the bug and had the exploit along with the some crash details like "int 
>> 3" Kernel Exception/Trap @ 0x01002FF3, different attack cases, exceptions 
>> of http/ftp and further debug logs; there was this bug published (though 
>> without the details of possible cases, exceptions and mouse hover 
>> techniques) couple of hours before I released it out at EvilFingers.
>>
>> So, I would like to convey due credit to Mr. JanDeMooij as well for his 
>> posting the bug on http://code.google.com/p/chromium/issues/detail?id=122, 
>> and thanks to Mr. Brennan for contacting me about the same.
>>
>> --
>> Thanks & Regards,
>> Rishi Narang | Security Researcher
>> Founder, GREYHAT Insight
>> Key: 0x8D67A3A3 (www.greyhat.in/key.asc)
>> www.greyhat.in
>>
>> .. eschew obfuscation, espouse elucidation.
>>
>> Wednesday, September 3, 2008, 5:43:40 AM, you wrote:
>>
>> > -----Original Message-----
>> > From: full-disclosure-bounces at lists.grok.org.uk
>> > [mailto:full-disclosure-bounces at lists.grok.org.uk] On Behalf Of Rishi
>> > Narang
>> > Sent: Tuesday, September 02, 2008 7:51 PM
>> > To: full-disclosure at lists.grok.org.uk
>> > Subject: [Full-disclosure] Google Chrome Browser Vulnerability
>>
>> > Hi,
>>
>> > ---------------------------------------------------
>> > Software:
>> > Google Chrome Browser 0.2.149.27
>>
>> > Tested:
>> > Windows XP Professional SP3
>>
>> > Result:
>> > Google Chrome Crashes with All Tabs
>>
>> > Problem:
>> > An issue exists in how chrome behaves with undefined-handlers in
>> > chrome.dll version 0.2.149.27. A crash can result without user
>> > interaction. When a user is made to visit a malicious link, which has an
>> > undefined handler followed by a 'special' character, the chrome crashes
>> > with a Google Chrome message window "Whoa! Google Chrome has crashed.
>> > Restart now?". It fails in dealing with the POP EBP instruction when
>> > pointed out by the EIP register at 0x01002FF4.
>>
>> > Proof of Concept:
>> > http://evilfingers.com/advisory/google_chrome_poc.php
>>
>> > Credit:
>> > Rishi Narang (psy.echo)
>> > www.greyhat.in
>> > www.evilfingers.com
>> > ---------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 7096 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20080904/6fe0f457/attachment.bin