[Snort-sigs] Webkit DoS -- سمَـَّوُوُحخ ̷̴̐خ ̷̴̐خ ̷̴̐خ امارتيخ ̷̴̐خ

L0rd Ch0de1m0rt l0rdch0de1m0rt at ...2420...
Fri Sep 6 12:33:37 EDT 2013


Hello.  Whoops, I accidentily sent the last email early (still getting used
to the new GMAIL interface and hit the wrong key-board combination for my
new key-board layout).  Anyway, here is the string:

سمَـَّوُوُحخ ̷̴̐خ ̷̴̐خ ̷̴̐خ امارتيخ ̷̴̐خ


Does anyone know why this happens and what other combination or sub-strings
can be used to exploit this? I ask so that we can make a SNORT rule for
it.  From my reading this is DoS and no RCE or BO that is known of.

Thanks.

Lord C.


On Fri, Sep 6, 2013 at 12:27 PM, L0rd Ch0de1m0rt
<l0rdch0de1m0rt at ...2420...>wrote:

> Hello.  I saw something recently that showed that this Arabic string can
> DoS Webkit programs:
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20130906/cb005418/attachment.html>


More information about the Snort-sigs mailing list