After submitting two bugs to the Mozilla project which
result in a browser lockup due to resource exhaustion I'm
a little confused.
I assume that if a DOS attack works, such that a
browser either crashes or must be killed this can
be a classified as a security attack.
Sure arbitary code isn't executed, but it's remote and
seems more "serious" than a random segmentation fault.
(Maybe I'm just increasing the severity because it's
annoying when my browser with N+1 tabs open crashes!)
Anybody have any thoughts?
(I guess it's more clear-cut when you can DOS a login
system such as PAM, rather than just one distinct
application).
Steve
--
# The Debian Security Audit Project.
http://www.debian.org/security/audit
|
