bugtraq - Re: Exploit/DoS in MS Internet Explorer 6.0 (OBJECT Tag)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <E195v94-0006nB-00@hawk.mail.pas.earthlink.net>
Date: Wed, 16 Apr 2003 18:12:46 -0400
From: "Roland Postle" <mail@...zde.co.uk>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	"Ryan Emerle" <securityFocus@...rle.net>
Subject: Re: Exploit/DoS in MS Internet Explorer 6.0 (OBJECT Tag)

>&lt;object id="test"
>       data="#"
>       width="100%" height="100%" 
>       type="text/x-scriptlet" 
>       VIEWASTEXT>&lt;/object&gt;

What I think is happening is that IE takes the URL '#' on it's own to
mean current document. (You can ahieve the same affect by specifying
data="document.html" where document.html is the name of the html file
running the code.)

When the data in the file '#' is embedded into the document and
executed it too contains the same object tag which embeds the document
again and again. Eventually it runs out of stack space. I doubt this is
exploitable on it's own except as a DoS.

- Blazde