Full Disclosure mailing list archives
Re: Crash IE with 11 bytes ;)
From: "Berend-Jan Wever" <skylined () edup tudelft nl>
Date: Wed, 28 Jul 2004 17:02:17 +0200
Here's a detailed description of what's going wrong with [STYLE]@;/* The problem is the unterminated comment "/*"; IE computes the length of the comment for a memcpy opperation by substracting the end pointer form the start pointer. The comment starts behind "/*" and should end at "*/", but since there is no terminator, the start of the string is used. IE there for calculates the string to be -2 unicode characters long. The subsequent memcpy will try to copy 0xFFFFFFFE bytes untill it gets a read or write exception. (You will see the offending instruction is a REP MOVSD) Unfortunately for us hackers, I believe you cannot control the length value for the memcpy other then setting it to -2. So you will always cause a read or write exception. You will only overwrite a small part of the heap before the exception is caused so overwriting the SEH to controlling execution is also ruled out. Conclusion: lame DoS I did find another way to use this to cause an exception at a different location: [SCRIPT] d = window.open().document; d.write("x"); d.body.innerHTML = "<STYLE>@;/*"; [/SCRIPT] This will crash because of a null pointer in a CMP [ESI], 0. It didn't look interesting to me, so no detailed investigation. Cheers, SkyLined ----- Original Message ----- From: "Phuong Nguyen" <phuong () ecqurity com> To: <full-disclosure () lists netsys com> Sent: Friday, July 23, 2004 19:17 Subject: [Full-disclosure] Crash IE with 11 bytes ;)
Hey, I thought you guys might want to know that it only takes 11 bytes to crash IE 5.x , 6.x SP1. CSS memory corruption vulnerability. All you need to do is <style>;@/* ;) simple as that. More details@ http://www.ecqurity.com/adv/IEstyle.html Phuong _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Crash IE with 11 bytes ;) Phuong Nguyen (Jul 23)
- Message not available
- Re: Crash IE with 11 bytes ;) Phuong Nguyen (Jul 23)
- RE: Crash IE with 11 bytes ;) Stephen Taylor (Jul 25)
- RE: Crash IE with 11 bytes ;) Phuong Nguyen (Jul 23)
- Re: Crash IE with 11 bytes ;) Trevor Curtis (Jul 24)
- Re: Crash IE with 11 bytes ;) Matt Houston (Jul 24)
- RE: Crash IE with 11 bytes ;) Arjun Pednekar (Jul 26)
- RE: Crash IE with 11 bytes ;) Stephen Taylor (Jul 27)
- Re: Crash IE with 11 bytes ;) Phuong Nguyen (Jul 23)
- Message not available
- Re: Crash IE with 11 bytes ;) The Central Scroutinizer (Jul 28)
- <Possible follow-ups>
- RE: Crash IE with 11 bytes ;) Schmidt, Michael R. (Jul 23)
- Message not available
- RE: Crash IE with 11 bytes ;) Phuong Nguyen (Jul 23)
- Message not available