bugtraq - vulnerability in the IE Java applet initialization engine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 4 Mar 2006 21:35:09 -0000
From: porkythepig@...pi.pl
To: bugtraq@...urityfocus.com
Subject: vulnerability in the IE Java applet initialization engine

There is a vulnerability in the Internet Explorer 
java applet handling engine. It occurs while running at Sun Microsystems Java VM and is caused by inproper HTML 'INPUT' control focus handling.
After focusing the control before the successful applet intialization numerous browser failures appears.

Beside a final DoS condition it causes also a failure in the keyboard and mouse input messages 
handling in browser (eg: AltF4, browser window close button, document text selection)

Sun Microsystems Java need to be installed and set as default VM for IE 
to exploit this vulnerability.

The same Sun Java VM version running at other browsers (eg: Firefox, Opera)
works fine and handles this exploitation conditions without any problems, which
means it is not the problem with Sun Microsystems Java but with wrong java applet handling
implemented in IE.

Successful exploitation of this vulnerability causes a DoS condition and a browser crash
during to nullpointer assignment in mshtml.dll module in one of IE threads.

The example DoS exploit including Java applet source code can be found at:
http://www.anspi.pl/~fex/rx6502.html

vulnerability found by: porkythepig