[37204] in bugtraq
home
help
back
first
fref
pref
prev
next
nref
lref
last
post
Rv: [Full-Disclosure] MSIE
and <FRAME> tag NAME property bufferoverflow PoC exploit (was: python does mangleme (with IE bugs!))</h2> <h4>daemon@ATHENA.MIT.EDU (Elia Florio)<br>Tue Nov 2 16:11:34 2004</h4> <pre>Message-ID: <20041102142112.29806.qmail@mail2.securityfocus.com> Date: Tue, 2 Nov 2004 15:32:45 +0200 From: "Elia Florio" <<A HREF="mailto:eflorio@edmaster.it">eflorio@edmaster.it</A>> To: "Berend-Jan Wever" <<A HREF="mailto:skylined@edup.tudelft.nl">skylined@edup.tudelft.nl</A>>, "<A HREF="mailto:full-disclosure@lists.netsys.com">full-disclosure@lists.netsys.com</A>"@securityfocus.com, "<A HREF="mailto:bugtraq@securityfocus.com">bugtraq@securityfocus.com</A>"@securityfocus.com Reply-To: "Elia Florio" <<A HREF="mailto:eflorio@edmaster.it">eflorio@edmaster.it</A>> Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="iso-8859-1"; MIME-Version: 1.0 Good job, the xploit works on both my : IE 6.0.2800.1106 ENGLISH with SHDOCVW.DLL version 6.0.2800.1400 IE 6.0.2800.1106 ITALIAN with SHDOCVW.DLL version 6.0.2800.1584 Tested on both Win XP Professional - SP1 with latest October patch installed. The overflow occurs in this point of SHDOCVW.DLL (with EAX = 0D0D0D0D) 7178E69E 8B40 34 MOV EAX,DWORD PTR DS:[EAX+34] 7178E6A1 85C0 TEST EAX,EAX 7178E6A3 74 21 JE SHORT SHDOCVW.7178E6C6 7178E6A5 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C] ... ... EF PS: after testing the xploit, Windows increased the swap file dimension sayin' VM memory too low, is this a side-effect of exploit? ________________________________________________ Messaggio inviato da Edizioni Master Webmail http://mbox.edmaster.it </pre> <hr> <table border=0 cellspacing=0 cellpadding=1> <tr align=center valign=center> <td width=44><a href="/"><img src="/images/i-d.gif" alt="" width=40 height=40></a></td> <td width=44><a href="/help.html"><img src="/images/i-help.gif" alt="" width=40 height=40></a></td> <td width=44><a href="./?37204"><img src="/images/i-back.gif" alt="" width=40 height=40></a></td> <td width=44><a href="1"><img src="/images/i-first.gif" alt="" width=40 height=40></a></td> <td width=44><img src="/images/n-fref.gif" alt="" width=40 height=40></td> <td width=44><img src="/images/n-pref.gif" alt="" width=40 height=40></td> <td width=44><a href="37203"><img src="/images/i-prev.gif" alt="" width=40 height=40></a></td> <td width=44><a href="37205"><img src="/images/i-next.gif" alt="" width=40 height=40></a></td> <td width=44><img src="/images/n-nref.gif" alt="" width=40 height=40></td> <td width=44><img src="/images/n-lref.gif" alt="" width=40 height=40></td> <td width=44><a href="42493"><img src="/images/i-last.gif" alt="" width=40 height=40></a></td> <td width=44><img src="/images/n-post.gif" alt="" width=40 height=40></td> </tr><tr align=center valign=center><td><a href="/">home</a></td> <td><a href="/help.html">help</a></td> <td><a href="./?37204">back</a></td> <td><a href="1">first</a></td> <td>fref</td> <td>pref</td> <td><a href="37203">prev</a></td> <td><a href="37205">next</a></td> <td>nref</td> <td>lref</td> <td><a href="42493">last</a></td> <td>post</td> </tr></table> </body></html>
