Full Disclosure mailing list archives
RE: Revisited Internet Explorer 6 DoS Bug
From: "Jason Eberly" <jeberly () bancfirst com>
Date: Tue, 8 Jul 2003 15:44:24 -0500
Windows XP Professional, 5.1.2600 SP1 IE 6.0.2800.1106.xpsp2.030422-1633 US English, plus East Asian language support. MS Outlook 2002 (10.2627.2625) I thought it might be fun to test how Outlook handled this, so I created a simple message and sent it to one of our E-mail administrators. The HTML formatted message, of course, contained a single line of text ("does this crash your mail client?") and the <img src ...> link from below. Crashed nicely, had to kill Outlook to recover. What's even funnier is he had his Inbox set on 'auto preview' ... tsk! tsk! As a result, subsequent restarts of Outlook would also hang up. We had to tinker around with Outlook Web Access (bleh!) to finally get rid of it (no auto preview, or at least not by default I think.) This would be super annoying if our users were getting DoS'd by it. Perhaps if nothing else it will encourage our E-mail admin not to run Auto Preview, heh! - Jason Eberly -----Original Message----- From: Peter Kruse [mailto:kruse () krusesecurity dk] <snip> This attack can also be conducted with HTML based e-mails. <yup!> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Revisited Internet Explorer 6 DoS Bug Jason Eberly (Jul 08)
- <Possible follow-ups>
- Re: Revisited Internet Explorer 6 DoS Bug Eric N. Valor (Jul 09)