Bugtraq mailing list archives
Re: [Full-Disclosure] Crash IE with 11 bytes ;)
From: "Berend-Jan Wever" <skylined () edup tudelft nl>
Date: Wed, 28 Jul 2004 17:02:17 +0200
Here's a detailed description of what's going wrong with [STYLE]@;/* The problem is the unterminated comment "/*"; IE computes the length of the comment for a memcpy opperation by substracting the end pointer form the start pointer. The comment starts behind "/*" and should end at "*/", but since there is no terminator, the start of the string is used. IE there for calculates the string to be -2 unicode characters long. The subsequent memcpy will try to copy 0xFFFFFFFE bytes untill it gets a read or write exception. (You will see the offending instruction is a REP MOVSD) Unfortunately for us hackers, I believe you cannot control the length value for the memcpy other then setting it to -2. So you will always cause a read or write exception. You will only overwrite a small part of the heap before the exception is caused so overwriting the SEH to controlling execution is also ruled out. Conclusion: lame DoS I did find another way to use this to cause an exception at a different location: [SCRIPT] d = window.open().document; d.write("x"); d.body.innerHTML = "<STYLE>@;/*"; [/SCRIPT] This will crash because of a null pointer in a CMP [ESI], 0. It didn't look interesting to me, so no detailed investigation. Cheers, SkyLined ----- Original Message ----- From: "Phuong Nguyen" <phuong () ecqurity com> To: <full-disclosure () lists netsys com> Sent: Friday, July 23, 2004 19:17 Subject: [Full-Disclosure] Crash IE with 11 bytes ;)
Hey, I thought you guys might want to know that it only takes 11 bytes to crash IE 5.x , 6.x SP1. CSS memory corruption vulnerability. All you need to do is <style>;@/* ;) simple as that. More details@ http://www.ecqurity.com/adv/IEstyle.html Phuong _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: [Full-Disclosure] Crash IE with 11 bytes ;) Berend-Jan Wever (Jul 28)