Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: VBScript Runtime Error'800a0006'
From: HACK the PLANET <edge-boarder () pop21 odn ne jp>
Date: Tue, 04 Mar 2008 15:41:13 +0900

Hi,WHITEHAT

The integer that can be usually treated with VBScript : up to 2147483647.
Because Mod tries to handle 120100406519 as integer because only integer can be treated and causes overflow.

Cheers, ;-)
--SINORNIS



whitehat wrote
Hi List,


I'm doing Web Application PT for a website which is using IIS-4.0.
I tried giving some bigger number in the parameters of the URL, which lead to the following error because of exceeding the upper limit of that particular Datatype:

Microsoft VBScript runtime error '800a0006'
Overflow:'CLng'

/....... .asp, line29

In almost all the URLs I found this issue.
I'm preparing a report advisory for this.
So I'd like to know what are the security issues related to this error.
How an attacker could be able to exploit this flaw.


Thanks in advance


Cheers,

--WHITEHAT






------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------




------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]