Microsoft IE iframe src DoS already reported to Microsoft

['ken'@FTU]

Security Professionals,

On Wednesday, April 7, 2004, Emmanouel Kellinis reported to Bugtraq that
the following HTML tag would cause IE to crash:

<iframe src="?">

Please see post:
http://www.securityfocus.com/archive/1/359767/2004-04-05/2004-04-11/0

I discovered this bug in January 2004 and reported it to Microsoft on
January 28, 2004.

After working with Microsoft, I decided to wait until the bug was fixed
before announcing it. In my opinion, this is part of responsible
disclosure.

I hope Microsoft will publicly reply to this post and confirm that I was
the individual who originally reported the bug to them.

'ken'@FTU



--
====================================
http://www.ftusecurity.com
Serving Straight HTML Since '02
====================================

[Valdis.Kletnieks@vt.edu]

--==_Exmh_2115272024P
Content-Type: text/plain; charset=us-ascii

On Thu, 08 Apr 2004 13:46:20 EDT, "'ken'@FTU" said:

> After working with Microsoft, I decided to wait until the bug was fixed
> before announcing it. In my opinion, this is part of responsible
> disclosure.

Congratulations. You just became another data point in the 'Microsoft fixes
bugs the fastest' survey done recently (which defined "fastest" as the time
between announcement and patch).....


--==_Exmh_2115272024P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAdav1cC3lWbTT17ARAnWkAJwOa+u0OC8MZ/9wQ/iHfMBVFJQKTgCfS6OA
vgWeSc9WmDr9mkoKuIGtLe0=
=FwqT
-----END PGP SIGNATURE-----

--==_Exmh_2115272024P--