Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: MSIE flaws: nested array sort() loop Stack overflow exception

from [isno] Network Security [Permanent Link]
Subject: Re: MSIE flaws: nested array sort() loop Stack overflow exception
Date: Fri, 26 Nov 2004 11:38:06 +0800 
I don't think this flaw is exploitable.In MSIE, any loop can lead to 
exception.Just like:

<IFRAME SRC=?>

save it as a html file, open it in IE, in about 30 seconds, it will cause a 
stack_overflow exception and exit. Because IE will not stop allocating stack 
buffer, until there is not enough stack space.  

= = = = = = = = = = = = = = = = = = = =


Hi all,

Another flaw in IE:

<HTML>
 <SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT>
 <SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT>
</HTML>

Normally I would see if it's exploitable but I figure I'm not MS's pet bug 
finder/analyser... So, I've CC'ed this message to Microsoft. I'm sure they 
know their own product better then I do and can analyse the problem much 
faster. So if you want to know the impact of this vulnerability, ask them: I'm 
sure they will be more then willing to help you. I'm sure they will even reply 
to this message with technical details and a patch tomorrow.

Added to the list: http://www.edup.tudelft.nl/~bjwever/advisory_ie_flaws.html

Cheers,
SkyLined
http://www.edup.tudelft.nl/~bjwever

PS. Don't think firefox will keep you save from hackers, I _know_ it won't ;) 
But more on that later...
PS2. Recursive function call will cause stack overflow causing write exception 
in guard page on a push, no control over registers.


= = = = = = = = = = = = = = = = = = = =
                        

                           Cheers, 
        isno
        isno@xfocus.org
          2004-11-26
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • Re: MSIE flaws: nested array sort() loop Stack overflow exception, isno <=
Previous by Date:  RE: [Full-Disclosure] Mailing lists and unsolicited/malicious spam, Todd Towles
Next by Date:  [Full-Disclosure] Re: Thank you!, Irwanhadi
Previous by Thread:  [Full-Disclosure] phpCMS <= 1.2.1 Xss Vulnerability, Information disclosure, Cyrille Barthelemy
Next by Thread:  [Full-Disclosure] [ GLSA 200411-35 ] phpWebSite: HTTP response splitting vulnerability, Matthias Geerdsen
Indexes:  [Date] [Thread] [Top] [All Lists]