Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2013-6668 PoC — Google Chrome Google V8 安全漏洞

Source
Associated Vulnerability
Title:Google Chrome Google V8 安全漏洞 (CVE-2013-6668)
Description:Google Chrome是美国谷歌(Google)公司开发的一款Web浏览器。Google V8是其中的一套开源JavaScript引擎。 Google Chrome 33.0.1750.144及之前版本中使用的Google V8 3.24.35及之前的版本中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务或产生其他影响。
Description
Test case for Node.JS V0.10.31 v8 backport CVE-2013-6668 crash
Readme
CveTest
=======

Test case to replicate [Node.JS](https://github.com/joyent/node/) [V0.10.31 v8 backport CVE-2013-6668](http://blog.nodejs.org/2014/08/19/node-v0-10-31-stable/) crash.

Test calls a SQL stored procedure ("GetSomething") to retrieve data from a table ("Table1") in "SQLDB" database. Crash occurs when there is more than 52 rows returned and after making the same call several times.

Environment
-----------
* Windows 7 64-bit
* MS SQL 2005
* Node.JS V0.10.31 x64
* tedious node module V1.4.3 or earlier

Tests with various flavours of Node
-----------------------------------
* Release mode node: script just exits unexpectedly without any explicit error printed.
* Debug mode node: [assertion and stack trace](log/node_stack_trace.txt) is obtained.
* Debug mode Node with temp patch proposed in [Node.JS Issue #8208](https://github.com/joyent/node/issues/8208): still crash as above.
  * Release mode is ok.
  * The assertion encountered is in HInstruction::Verify() which is only available in DEBUG build. Thus, the alternate release build codes appear not to suffer from the CVE patch.
* Node V0.10.31 with deps/v8 from V0.10.30: No crash, works fine.
Thus, it appears to be the v8 backport CVE-2013-6668 patch that is causing the problem.

Maybe Related
-------------
* [node-mssql Issue #74](https://github.com/patriksimek/node-mssql/issues/74)
File Snapshot

[4.0K] /data/pocs/351500dc957d60fae199c98d5a6b15fac0e3094e ├── [4.0K] data │   ├── [ 719] SQLQuery_CreateSP_GetSomething.sql │   ├── [ 397] SQLQuery_CreateTable1.sql │   └── [1.3K] table1_sample.csv ├── [4.0K] log │   └── [ 43K] node_stack_trace.txt ├── [1.3K] README.md └── [3.4K] test_cve.js 2 directories, 6 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.