full-disclosure - Re: Internet Explorer 6 CSS "expression" Denial of Service Exploit (P.o.C.)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 8 Dec 2006 18:46:58 +0100
From: "chinese soup" <noodle.mastah@...il.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Re: Internet Explorer 6 CSS "expression" Denial
	of Service Exploit (P.o.C.)

(waiting for the deluge of other lemmings who go:
"it works on blahblah with SPblahblah"
"confirmed on blahblah with blahblah language"
"blablah did not work for me blahblah"

can't you just find out the cause and not test EVERY version of IE
that you have? I mean, yeah, ok, so you tested it on IE7 yeah big
deal. he reports it on IE6.

you know why it is "putting iexplore.exe at 100% CPU"?

It's like when a truck crashes into a car and everyone goes out and
tests the truck against their own cars:
"Hey, the truck also totally destroyed my Ford Explorer!"
"Oh, it also totalled my Toyota!".
"Nope, it had no effect on my tank"

yeah i mean i COULD test it, but i'm too busy with... ehrm... cooking.
yes cooking.

cooking,

"i like my noodles boiled, not fried. well, sometimes fried"

On 12/7/06, Andrius Paurys <andrius.paurys@...il.com> wrote:
> On 12/6/06, José Carlos Nieto Jarquín <xiam.core@...il.com> wrote:
> > Note:
> > I'm sorry, two of the the exploits in the prior e-mail were incomplete.
> >
> > This is just another couple of proof of concept exploits for this
> > well-known browser. The third one is a lame combination of both.
> >
> > Tested under Windows XP SP2, MSIE 6.0.2900.2180
>
>
> Also confirmed working on Windows Server 2003 R2 (Build 3790) with
> Internet Explorer 7.0.5730.11
>
> 1st exploit was working fine putting iexplore.exe at 100% CPU. It
> complained about "IE restricting this web page from running scripts"
> (probably because of enabled Internet Explorer Enhanced Security
> Configuration), but if you click "allow this website to run this"
> (which is enabled by default if above mentioned IE ESC is not present)
> it works.
>
> 2nd and 3rd were not exactly working, (also because of IE ESC) because
> after clicking allow after several windows it was asking again, but
> should work on WinXP and IE7.
>
>
>
> --
> Andrius Paurys
> $h@MAN
>
> andrius.paurys@...il.com
> Tel.: +37067449273
> ICQ: 279424019
> MSN: andrius.paurys@...il.com
> http://shaman.tinkle.lt/
>
> I'm Lithuanian, what's _your_ excuse?
> Sėdi programeris nevalgęs ir nieko...
>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/