Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can create an HTML page containing a complex regular
expression, and transmit it to a Firefox or Kaspersky user, in
order to trigger a denial of service.

Impacted products: Kaspersky AV, Firefox

Severity: 1/4

Creation date: 19/03/2014

DESCRIPTION OF THE VULNERABILITY

An HTML page can contain JavaScript code, which uses a regular
expression.

The Firefox product can display this web page, and the Kaspersky
antivirus can analyze it.

However, if the regular expression is complex, these products
consume numerous resources or stop.

An attacker can therefore create an HTML page containing a complex
regular expression, and transmit it to a Firefox or Kaspersky
user, in order to trigger a denial of service.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Firefox-Kaspersky-denial-of-service-via-RegExp-14447