Bugtraq mailing list archives

Re: MS IIS 5.0 Access Violation on handling URL String

From: imrang () BTINTERNET COM (Imran Ghory)
Date: Tue, 18 Jan 2000 21:49:08 -0000


On 14 Jan 00, at 23:41, Anthony Benjamin wrote:

This URL also causes Netscape 4.7 (Win 98) to crash when used as a
location..
So if you embedded it into something, Javascript or otherwise, you could
probably have some fun.

NETSCAPE caused an invalid page fault in
module <unknown> at 0000:2e2e2e2e.
Registers:
EAX=00000000 CS=015f EIP=2e2e2e2e EFLGS=00010246
EBX=0094a5d0 SS=0167 ESP=00b351c4 EBP=2e2e2e2e
ECX=00000000 DS=0167 ESI=0000cc6a FS=1a6f
EDX=81b1200c ES=0167 EDI=00b426c8 GS=0000
Bytes at CS:EIP:

Stack dump:
2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e
2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e 2e2e2e2e


Ditto for Opera 3.51,

OPERA caused an invalid page fault in
module OPERA.EXE at 014f:004aff1d.
Registers:
EAX=0076f5d0 CS=014f EIP=004aff1d EFLGS=00010246
EBX=00000000 SS=0157 ESP=0076f490 EBP=0076f6d8
ECX=0076faec DS=0157 ESI=00000000 FS=23af
EDX=005016d5 ES=0157 EDI=2e2e2e2e GS=0000
Bytes at CS:EIP:
80 3f 00 74 3f 57 e8 e8 04 03 00 59 8d 74 38 ff
Stack dump:
00000000 bfc04db6 004bb98e 2e2e2e2e bfc04db6 bfc02333 17df0002 00026034 00000808
17df05ee 00026034 08080047 84f20000 07af44e5 31d78556 000257f0

Imran

Current thread:

MS IIS 5.0 Access Violation on handling URL String Lark Lizerman (Jan 13)
- Re: MS IIS 5.0 Access Violation on handling URL String Anthony Benjamin (Jan 14)
  - Re: MS IIS 5.0 Access Violation on handling URL String Imran Ghory (Jan 18)
- Re: MS IIS 5.0 Access Violation on handling URL String David Litchfield (Jan 15)
  - Re: MS IIS 5.0 Access Violation on handling URL String Lark Lizerman (Jan 15)
- Yahoo Pager/Messanger Buffer Overflow Jaynus Jaynus (Jan 16)
- <Possible follow-ups>
- Re: MS IIS 5.0 Access Violation on handling URL String Michael Howard (Jan 17)
- Re: MS IIS 5.0 Access Violation on handling URL String Michael Howard (Jan 18)