Vulnerability Development mailing list archives

true garbage


From: "perkere stinker" <doe_i_sorte_skodder () hotmail com>
Date: Sun, 22 Jul 2001 18:36:36 +0000

excuse me. this sucks.

a link/ meta refresh/ body.onload javascript pointing to ms-its: (in HKEY_CLASSES_ROOT\PROTOCOLS\Handler near its: (same classid same thing) repeated 37 times and ending with a .(a dot yes, since the protocol needs something to open.) (seem familiar?) will crash the program calling it with a fault in urlmon.dll, sometimes kernel32.dll.

no need to contact ms since its not critical from their viewpoint, bugs are unimportant to them (they told me, really) - only full-scale exploits matter. Just crashing their widely used software isn't enough. The its: crash is quite old, but still works (which just supports my statement, ms doesn't care.) Crashes IE5.x / outlook express / outlook,also my computer tends to really suck after a few crashes. I suppose it has something to do with the version of urlmon.dll, i have version 5.50.4522.1800, oddly enough the same version number as my outlook express. As a side note, check the version of the dll file, mine says 'Microsoft(R) Windows (R) 2000 Operating System' as value for 'product name'.. i use win98se.

People with urlmon.dll ver. 5.50.4701.2400 might experience different behaviour, i had 2 ppl test it (reg0018 and hund), both with that dll version(which differs from their OE ver.), and their browsers simply exited without warning.

I suppose it's not a big problem, it just sucks if you have your preview pane on. My outlook(not express) didn't 'hide' the last email i viewed, so i had to start the program a few times while pounding the 'up' arrow at first and then moving in for a swift left-click - delete blow. I know ludo.

besides,
something related to outlook express 5.5, make some html similar to
<META HTTP-EQUIV="REFRESH" CONTENT="0;URL=mailto:[buf]";> (where [buf] is appx. 2000 chars) or just <a href=mailto:[buf]>blabla</a> - it will display an error box stating 'could not perform this operation because the default mail client is not properly installed'. Or stick it in an <iframe src=mailto:[buf]> in some html email.

you should also try the above things with news:blablabla@loadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphere instead of mailto:[buf] - Displays another pretty error about not being able to start outlook express, and to check if disks are full or if you're out of memory. directions to contact ms support, and an error code as well,0x80004005 ... cool with javascript like


<script>
var pik;
var temp;
function test(temp) {
pik = temp * 100
setTimeout("window.location.href='news:blablabla@loadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphereloadsofcraphere'",pik);
}
for (i=0;i<50;i++) {
 test(i);
}
</script>

results vary with protocol, and varies also depending on how many times you let the while loop run. 1000 crashes iexplore.exe a lot of times, stating 'the instruction at 0x00000000 referenced memory at 0x000000. the memory could not be "read"'. 10000 is too many, the mail windows never appear, iexplore just hangs.

OE 5.5 complains about not being able to load msoe.dll and a lot more crap.
Also killed all instances of mozilla 0.9.2

pizza. yum.

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp


Current thread: