Kmail (table/frameset) DoS 16 Oct. 2006    Summary "KMail is a fully-featured email client that fits nicely into the K Desktop Environment, KDE. It has features such as support for IMAP, POP3, multiple accounts, powerful filters, PGP/GnuPG privacy, inline attachments, and much more." Kmail can be crashed due to incorrectly parsing certain HTML elements.   Credit: The information has been provided by nnp.    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * KDE 3.5.2 and kmail 1.9.1 (tested on) Background: Kmail is a HTML compatible email client that comes installed by default with the KDE desktop. This DOS requires HTML parsing to be enabled. This can be done in Kmail by going to Settings -> Configure Kmail ->Security -> and tick Prefer HTML to Plain Text. Description: Kmail can be crashed due to incorrectly parsing certain HTML elements. In this case the a combination of the and tags are incorrectly parsed leading to a segmentation fault. A sample mail can be found here http://silenthack.co.uk/nnp/exploits/kmail/tableCrash. To reproduce the crash, copy the above mail into your local mail spool file (e.g /var/mail/`whoami`) or send it to yourself (without the email headers obviously). Double click the new mail and when it opens close it again. On closing it the program should crash and give the following stack trace: [KCrash handler] #6 0xb790a334 in free () from /lib/tls/i686/cmov/libc.so.6 #7 0xb7aab8b1 in operator delete () from /usr/lib/libstdc++.so.6 #8 0xb7aab8fd in operator delete[] () from /usr/lib/libstdc++.so.6 #9 0xb6cd05d8 in non-virtual thunk to DOM::HTMLObjectBaseElementImpl::~HTMLObjectBaseElementImpl() () from /usr/lib/libkhtml.so.4 #10 0x084de030 in ?? () #11 0x084d03e8 in ?? () #12 0x00000001 in ?? () #13 0xb6e43aec in ?? () from /usr/lib/libkhtml.so.4 #14 0x084d03e8 in ?? () #15 0x00000000 in ?? ()  Comments:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles PHP dba_replace() Arbitrary File Destruction VLC Media Player RealText Processing Stack Overflow Vulnerability LibSPF2 DNS TXT Record Parsing Bug GNU Enscript "setfilename" Special Escape Buffer Overflow File-Find-Object Format String Vulnerability Veritas Storage Foundation Arbitrary File Read Vulnerability Sun Solstice AdminSuite sadmind adm_build_path() Buffer Overflow Vulnerability Apache Tomcat Information Disclosure (RemoteFilterValve) Apple CUPS HP-GL/2 filter Code Execution Vulnerability WordPress MU wpmu-Blogs.php Crose Site Scrpting Vulnerability strongSwan IKEv2 Denial of Service Vulnerability Cross-Site Scripting Filter Evasion in Various Frameworks / Applications MySQL Charset Truncation Vulnerability Wordpress user_login Column SQL Truncation Vulnerability Joomla Weak Random Password Reset Token Vulnerability  Featured Articles Hacking SOHO Routers LibSPF2 DNS TXT Record Parsing Bug Vulnerability in Server Service Allows Code Execution (MS08-067) Opera Stored Cross Site Scripting Vulnerability GearSoftware Powered Products Local Privilege Escalation (IopfCompleteRequest) Vulnerabilities in Microsoft Excel Allows Code Execution (MS08-057) VMware Emulation Flaw x64 Guest Privilege Escalation
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2008 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®