Exploit/DoS in MS Internet Explorer 6.0 (OBJECT Tag)

[Ryan Emerle]

*Description*
Microsoft Internet Explorer 6.0 (other versions not tested) is vulnerable
to a DoS when specially crafted html is present on a page. The
vulnerability is in the processing of the OBJECT tag.

*Tested*
OS: Windows 2000 Pro SP3 (fully up-to-date)
IE: Internet Explorer 6.0.2800.1160 SP1

*Ramifications*
When the specially crafted HTML is present in a page, Internet Explorer
will forcefully terminate all open sessions. The client machine is
otherwise unharmed. Further ramifications have not been investigated.

*Proof of Concept*
The following HTML code will cause the above version of Internet Explorer
to forcefully terminate:

<object id="test"
data="#"
width="100%" height="100%"
type="text/x-scriptlet"
VIEWASTEXT></object>

--
Ryan Emerle, BSCS
Lead Systems Developer
Interactive Network Systems, Inc.
http://www.ins-business.com

[Roland Postle]

><object id="test"
> data="#"
> width="100%" height="100%"
> type="text/x-scriptlet"
> VIEWASTEXT></object>

What I think is happening is that IE takes the URL '#' on it's own to
mean current document. (You can ahieve the same affect by specifying
data="document.html" where document.html is the name of the html file
running the code.)

When the data in the file '#' is embedded into the document and
executed it too contains the same object tag which embeds the document
again and again. Eventually it runs out of stack space. I doubt this is
exploitable on it's own except as a DoS.

- Blazde

[Steve Ryan]

I tried on Windows XP SP1 + all patches/hotfixes w/ IE 6 SP1 + all
patches/hotfixes and it seemed to work just fine.



-----Original Message-----
From: Ryan Emerle [mailto:securityFocus@emerle.net]
Sent: Wednesday, April 16, 2003 12:56 PM
To: bugtraq@securityfocus.com
Subject: Exploit/DoS in MS Internet Explorer 6.0 (OBJECT Tag)



*Description*
Microsoft Internet Explorer 6.0 (other versions not tested) is
vulnerable
to a DoS when specially crafted html is present on a page. The
vulnerability is in the processing of the OBJECT tag.

*Tested*
OS: Windows 2000 Pro SP3 (fully up-to-date)
IE: Internet Explorer 6.0.2800.1160 SP1

*Ramifications*
When the specially crafted HTML is present in a page, Internet Explorer
will forcefully terminate all open sessions. The client machine is
otherwise unharmed. Further ramifications have not been investigated.

*Proof of Concept*
The following HTML code will cause the above version of Internet
Explorer
to forcefully terminate:

<object id="test"
data="#"
width="100%" height="100%"
type="text/x-scriptlet"
VIEWASTEXT></object>

--
Ryan Emerle, BSCS
Lead Systems Developer
Interactive Network Systems, Inc.
http://www.ins-business.com

In-Reply-To: <20030416195550.2126.qmail@www.securityfocus.com>

>*Description*
>Microsoft Internet Explorer 6.0 (other versions not tested) is
>vulnerable to a DoS when specially crafted html is present on a page.
>The vulnerability is in the processing of the OBJECT tag.

A *year-old* DoS. This is one good reason for researchers to make sure
they aren't posting duplicates. I've criticized Microsoft's support
policies in the past for cutting off support channels for small bugs such
as this.

On a more positive note, I'd like to add that Microsoft is apparently re-
investigating this issue to determine why I wasn't able to squeeze at
least a service-pack fix out of them. :-)

W2ksp3 is not vulnerable to the bug in the same way that other OSes are;
MS nicely patched it so that it displayed a warning when processing
folder templates over a network. Other systems lack this protection, and
will happily download and script folder content over a hostile network.
By crafting the folder template to exploit this, you could cause an
infinite loop on some Windows versions, as the shell crashes, and
restarts automatically -- with its folders intact. This starts an ugly
spiral until the system becomes unusable from the console, and must be
restarted. Worse, similar behavior occurs the next time a user logs in --
the system must be un-plugged from the internet to prevent the mess from
starting over.