Vulnerability Development mailing list archives
Re: Crash IE with shell://:
From: cory <loon () loadedpenguin com>
Date: Tue, 22 May 2001 12:31:53 -0500 (CDT)
On Tue, 22 May 2001, Kayne Ian (Softlab) transferred the following data:
All... Wrote this little thing in a few spare mins. I'm no use with javascript or webbased coding, so I'm sure there's much more you could do with this. Anyway, attached is a .html that crashes all the machines I tested it on - be prepared to loose explorer.exe if you run it. I guess this is a working exploit/bug (and a really annoying one if it starts appearing on the web), so if someone wants to forward this to the appropriate people (bugtraq? microsoft?) then go for it... Also, if we could narrow down exactly what it takes to fix it in the current versions, that would be good too. enjoy... Ian Kayne Technical Specialist - IT Solutions Softlab Ltd - A BMW Company
Tried this against IE 5 ver. 5.00.2614.3500 with little result. The .htm shows up for a few seconds, then you recieve a 404 , with the Address box changing from http://blah.com/iecrashtest.htm to just /test.htm (strange?). During the change to a 404, a smaller box appears with res://C:\\Windows\System\SHDOCLC.DLL/syntax.htm explaining that the page can not be displayed, possibly because of removal or name change. It then request you do the following: Open the res://C:\WINDOWS\SYSTEM\SHDOCLC.DLL/syntax.htm#shell:// home page, and then look for the links to the information you want. Hope that helps cory
Current thread:
- Crash IE with shell://: Kayne Ian (Softlab) (May 22)
- Re: Crash IE with shell://: CJ Oster (May 22)
- Re: Crash IE with shell://: cory (May 22)
- <Possible follow-ups>
- Re: Crash IE with shell://: Peter (May 23)
- Re[2]: Crash IE with shell://: Kevin J. Menard, Jr. (May 23)
- Re: Crash IE with shell://: Dino Amato (May 23)
- RE: Re[2]: Crash IE with shell://: Chris Tobkin (May 23)
- New/Hidden/Unimplemented IE Protocols (Re: Crash IE with shell://:) Usman Akeju (May 24)
- Re: Re[2]: Crash IE with shell://: Bob Fiero (May 23)
- RE: Re[2]: Crash IE with shell://: Kayne Ian (Softlab) (May 24)
- Re:Re[4]: Crash IE with shell://: Peter (May 24)
- Re: Crash IE with shell://: exceed mekka-symposium (May 24)