Vigil@nce - Firefox, Kaspersky: denial of service via RegExp
March 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can create an HTML page containing a complex regular
expression, and transmit it to a Firefox or Kaspersky user, in
order to trigger a denial of service.
Impacted products: Kaspersky AV, Firefox
Severity: 1/4
Creation date: 19/03/2014
DESCRIPTION OF THE VULNERABILITY
An HTML page can contain JavaScript code, which uses a regular
expression.
The Firefox product can display this web page, and the Kaspersky
antivirus can analyze it.
However, if the regular expression is complex, these products
consume numerous resources or stop.
An attacker can therefore create an HTML page containing a complex
regular expression, and transmit it to a Firefox or Kaspersky
user, in order to trigger a denial of service.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Firefox-Kaspersky-denial-of-service-via-RegExp-14447