bugtraq - IE6 SP1 - Click N Crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 15 Feb 2005 15:21:29 +0000 (GMT)
From: ViPeR <viper31337@...oo.co.in>
To: bugtraq@...urityfocus.com
Subject: IE6 SP1 - Click N Crash

hi,

Affected Software : Microsoft Internet Explorer
Vulnerability : Remote DOS / Crash
Tested On : MS IE 6.0 SP1, Win2K SP4, [up-to-date]
according to windowsupdate.com

Discovered by : Gregory R. Panakkal

HomePage : http://www.crapware.tk

Details
=======
Pointing a link to the URI -> file://!:\ [replace !
with the character with ascii value for eg:- 0xA0].
Causes IE6-SP1 to crash, the illegal op occuring in
user32.dll. Other special characters are also
possible.

Demo
====
A demonstration is available at the following URL.

http://crapware.lx.ro/junkcode/security/ie-sp1-file-a0-crash.htm

Greetz to
=========
Rakesh Balasunder - r0ck@...y
CK - Saitegog! :)

rgds,
Gregory R. Panakkal 

________________________________________________________________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony