KDE Konqueror Malformed HTML Page Denial of Service Vulnerability

Bugtraq ID:	7486
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 02 2003 12:00AM
Updated:	May 02 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Joachim_Strombergson <[email protected]>.
Vulnerable:	KDE Konqueror 3.0.3 + KDE KDE 3.0.3
Not Vulnerable:	KDE Konqueror 3.1.1 + KDE KDE 3.1.1

KDE Konqueror Malformed HTML Page Denial of Service Vulnerability

KDE Konqueror has been reported prone to a denial of service vulnerability when rendering a HTML page that contains malformed data.

Although unconfirmed, code execution may be possible.

The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available.

KDE Konqueror Malformed HTML Page Denial of Service Vulnerability

The following proof of concept has been supplied:

perl -e "print qq'\xFF\xFE'; print qq'\r\r\n' x 30000" > freeze.htm

KDE Konqueror Malformed HTML Page Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

KDE Konqueror Malformed HTML Page Denial of Service Vulnerability

References:

• Konqueror Homepage (Konqueror)
  
• Re: April appeared to be a month of IE bugs. Here's another one. (Joachim_Strombergson )