[34468] in bugtraq
Microsoft IE iframe src DoS already reported to Microsoft
daemon@ATHENA.MIT.EDU ('ken'@FTU)
Thu Apr 8 14:40:45 2004
Date: Thu, 08 Apr 2004 13:46:20 -0400
From: "'ken'@FTU" <ken@ftusecurity.com>
To: bugtraq@securityfocus.com
Cc: secure@microsoft.com
Message-id: <1081446380.1048.46.camel@localhost.localdomain>
MIME-version: 1.0
Content-type: text/plain
Content-transfer-encoding: 7BIT
Security Professionals,
On Wednesday, April 7, 2004, Emmanouel Kellinis reported to Bugtraq that
the following HTML tag would cause IE to crash:
<iframe src="?">
Please see post:
http://www.securityfocus.com/archive/1/359767/2004-04-05/2004-04-11/0
I discovered this bug in January 2004 and reported it to Microsoft on
January 28, 2004.
After working with Microsoft, I decided to wait until the bug was fixed
before announcing it. In my opinion, this is part of responsible
disclosure.
I hope Microsoft will publicly reply to this post and confirm that I was
the individual who originally reported the bug to them.
'ken'@FTU
--
====================================
http://www.ftusecurity.com
Serving Straight HTML Since '02
====================================
