25 Sep 08 Chrome Security Alert - Carriage Return Null Object Memory Exhaustion Remote Dos
Here’s a security alert for Google Chrome, it seems like some kind of memory leak problem with the Enter key:
*Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.*
*Version Affected:*
Chrome/0.2.149.30
Chrome/0.2.149.29*Severity:*
High*Description:*
The Google chrome browser is vulnerable to memory exhaustion based
denial of
service which can be triggered remotely.The vulnerability triggers when
Carriage
Return(\r\n\r\n) is passed as an argument to window.open() function. It
makes the
Google Chrome to generate number of windows at the same time thereby
leading
to memory exhaustion. The behavior can be easily checked by looking at
the task
manager as with no time the memory usage rises high. The problem lies in
the handling
of object and its value returned by the javascript function. Once it is
triggered the pop
ups are started generating. The Google Chrome browser generate object
windows continuously
there by affecting memory of the resultant system. Probably it can be
crashed within no time.
User interaction is required in this.*Proof of Concept*
http://www.secniche.org/gds*Links:*
http://secniche.org/gcrds.html
http://evilfingers.com/advisory/Google_Chrome_Carriage_Return_Null_Objec
t_Memory_Exhaustion_Remote_Dos.php*Detection:*
SecNiche confirmed this vulnerability affects Google Chrome on Microsoft
Windows XP SP2 platform.The versions tested are:Chrome/0.2.149.30
Chrome/0.2.149.291*Disclosure Timeline:*
Disclosed: 22 September 2008
Release Date. September 24 ,2008*Vendor Response:*
Google acknowledges this vulnerability and “fix” will be released soon.*Credit:*
Aditya K Sood*Disclaimer*
The information in the advisory is believed to be accurate at the time
of publishing based on
currently available information. Use of the information constitutes
acceptance for use in an
AS IS condition. There is no representation or warranties, either
express or implied by or with
respect to anything in this document, and shall not be liable for a ny
implied warranties of
merchantability or fitness for a particular purpose or for any indirect
special or consequential
damages.
via securityfocus
Tags:carriage return, Chrome News, Chrome Security Flaws/Bugs, denial of service, dos version, google, javascript function, memory exhaustion, memory leak problem, memory usage, null object, object memory, pop ups, proof of concept, resultant system, security alert, sood, task manager, time user, vulnerability
17 Sep 08 Chrome Tips - Chrome Channel Switcher allows you to switch between Chrome beta and dev versions!
You can now download the Chrome Channel Switcher, which allows you to switch between the “beta” Chrome and “Dev” Chrome. The Beta Chrome are the stable releases whereas the Dev Chrome is updated as soon as a bug or security flaw is fixed.
This will help you to try out the latest fixes and features using the “Dev” mode.
Here’s how to do it from the Chromium Dev site:
Tags:channel chooser, channel switcher, Chrome Development, Chrome News, Chrome Resources, Chrome Security Flaws/Bugs, chrome tips, chrome tips, chromium, current release, google, Google Chrome Hacks, security flaw, service pack 1, stable releasesSubscribing to the Dev channel
- Download and run the Google Chrome Channel Chooser (http://chromium.googlecode.com/files/chromechannel-1.0.exe).
- Click the circle next to Dev.
- Click Update to save your choice.
- Click Close.
- In Google Chrome, click the wrench menu and choose About Google Chrome.
Note: On Windows Vista, updates from the About box require Service Pack 1. With 0.2.149.29 (the current release), on demand updates do not work in Vista SP1 if User Account Control is disabled.- Click Update Now to install the current Dev channel release.
- Restart Google Chrome.
08 Sep 08 Google Chrome Anonymizer anonymizes your Client ID!
Since Google Chrome assigns a Client ID during a Chrome download, you can use the Google Chrome Anonymizer to anonymize your surfing experience.
I don’t know how Google uses the Client ID but just in case you are a super-security freak, you can use the Google Chrome Anonymizer to keep your web surfing safer.
Here’s the code:
Download: chrome_anonymizer_1.0.0.4.zip
Update:
The source code (VisualStudio 2008) can be obtained from this location: chromeanonymizer_src_1.0.0.4.zip
via gjl-network
Tags:anonymizer, Chrome News, Chrome Security Flaws/Bugs, chrome tips, client id, freak, google, source code, surfing experience
06 Sep 08 More Chrome Security Flaws
Since Google Chrome is still officially, “beta”, there will be a lot of security flaws and bugs that need to be fixed.
I heard about a security flaw where users are not promoted before downloading last week and Google has fixed it but here’s another one found by a company:
Vietnamese security company Bach Khoa Internet Security (BKIS) has found a flaw in Google Chrome 0.2.149.27 and posted details on its Web site. The company says the problem is a critical buffer-overflow vulnerability that could allow a hacker to perform a remote attack and take complete control of the affected system.
Here’s the proof of concept code:
An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 0.2.149.27. A crash can result without user interaction. When a user is made to visit a malicious link, which has an undefined handler followed by a ’special’ character, the chrome crashes with a Google Chrome message window “Whoa! Google Chrome has crashed. Restart now?”. It crashes on “int 3″ at 0×01002FF3 as an exception/trap, followed by “POP EBP” instruction when pointed out by the EIP register at 0×01002FF4.
I am sure Google will get this little bug fixed real soon but in the meanwhile, you can send any bugs you find to: tips [at] chrome-hacks.net.
via informationweek
Tags:bach khoa, bkis, buffer overflow vulnerability, bugs, Chrome News, Chrome Security Flaws/Bugs, complete control, crash, crashes, ebp, google, hacker, hacks, internet security, little bug, message window, proof of concept, security company, security flaw, security flaws
