full-disclosure - Internet Explorer 6 DoS Bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20030708170411.GZ29148@spiro.dyndns.org>
From: trikaliotis at ivs.cs.uni-magdeburg.de (Spiro Trikaliotis)
Subject: Internet Explorer 6 DoS Bug

Hello brett,

On Tue, Jul 08, 2003 at 02:42:30PM +1000, Brett Hutley wrote:

> > If you enter C:\aux in the adressline of the IE (not EXPLORER,
> > InternetExplorer) and hit enter, the window will freeze. This bug
> > is simmilar to C:\con\con
> 
> The problem seems to be related to whether you have permissions to
> access the AUX device or not. I couldn't freeze explorer on my notebook
> where I don't have permissions to the aux device, but could on a
> co-workers machine in which we could access the aux device from the
> command line.

a good point.

My Win 2000 machine which did not have problems did not have any serial
devices, so it's not very surprising that this was not a problem.

On the other hand, my XP system, which had the problem, does own a serial 
port.

For a quick test, I added a serial port on Com1: to the W2K machine and 
entered c:\aux again in IE6: It freezes, too.

Could it be that the computers of the people who told us "no problems"

1. don't have a serial port,
2. don't have a COM1,
3. have a mouse on COM1,
4. have the debugger (WinDBG) on COM1, or
5. don't have a "real" COM1 but only a virtual one (for example, COM1 
   is a virtual device of the bluetooth device)?

That could explain why there are not freezes.

Furthermore, yesterday, I said that I had to log out for my machine to be
operable again, since the explorer crashed, too, and did not restart again.
With my tests today, I could not reproduce that part, explorer crashed while
killing IE, but it restarted immediately. So, this could be unrelated.

Just some more investigations from my side,
   Spiro.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030708/83d64628/attachment.bin