full-disclosure - Microsoft Internet Explorer (mshtml.dll)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Mar 22 17:14:14 2006
From: stelian.ene at gecadtech.com (Stelian Ene)
Subject: Microsoft Internet Explorer (mshtml.dll) -
	Remote	Code Execution

Computer Terrorism (UK) :: Incident Response Centre wrote:
> Pursuant to the publication of the aforementioned bug/vulnerability,
> this document serves as a preliminary Security Advisory for users of
> Microsoft Internet Explorer version 6 and 7 Beta 2.
> Successful exploitation will allow a remote attacker to execute
> arbitrary code against a fully patched Windows XP system, yielding
> system access with privileges of the underlying user.

So this is indeed a n-day vulnerability, with n a small positive integer.
I must stress that I'm not the original author, and that I've seen this bug
discussed in public forums as early as 19.03.2006. If exploitation is as easy as
you claim, then probably the bad guys are already actively using this, just like
they did with WMF.

Oldest POC I've found, by 'shog9' (Joshua Heyer):
http://www.shog9.com/crashIE.html