Microsoft IE Recursive Scripting, Embedded Files, window() and Restricted Sites DoS
31 May. 2005
Summary
"Internet Explorer, abbreviated IE or MSIE, is a proprietary web browser made by Microsoft and currently available as part of Microsoft Windows. Internet Explorer is by far the most widely used web browser, although since 2004 it has lost some usage share to other browsers." - (Wiki)
Multiple stack and buffer overflow vulnerabilities have been discovered in Microsoft Internet Explorer, exploiting these vulnerabilities allows malicious attacker to crash a vulnerable browser.
Vulnerable Systems:
* Microsoft Internet Explorer 6 SP2 (6.0.2900.2180.xpsp_sp2_gdr.050301-1519) on a fully patched Windows XP SP2 system.
* MSHTML.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* BROWSEUI.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* SHDOCVW.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* SHLWAPI.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* URLMON.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
* WININET.DLL: 6.00.2900.2627 (xpsp_sp2_gdr.050309-1648)
Recursive Scripting Stack overflow:
There is a bug in Microsoft Internet Explorer, which causes a crash in NTDLL.DLL. The bug occurs, because Microsoft Internet Explorer can't handle large amounts of (over 110) stack overflows. On Windows 98 SE you will get an error in KERNEL32.DLL.
Proof of concept:
<script>
window.onerror=new Function("history.go(0)");
function btf(){btf();}
btf();
</script>
Workaround:
Deactivate "Active Scripting" in the IE options menu.
Processing Embedded Files within an Endless Loop (DoS):
The crash occurs, because Microsoft Internet Explorer doesn't limit the depth of embedded files.
Proof of Concept:
Page #1 (save as "btf1.htm"):
<html><head><title>BTF - MSIE crash</title></head><body>
<object data="./btf2.htm" width="0" height="0"></object>
</body></html>
Workaround:
Deactivate "ActiveX" in the IE options menu.
JavaScript window() (DoS):
The crash occurs because Microsoft Internet Explorer can't handle a call to a JavaScript-function with the name of the "window"-object. The bug was fixed in earlier versions, but has resurfaced.
Proof of Concept:
<body onLoad="window()">
Workaround:
Deactivate "Active Scripting" in the IE options menu.
Adding Sites to Restricted Zone Causes a DoS:
The bug occurs, because Microsoft Internet Explorer can't handle adding of special-formed URLs to the restricted zone. To crash IE, the URL must begin with numbers and dots (like a correct IP address), but it must not end like a IP address.
Proof of Concept:
Add to restricted zone: 4.3.2.1btf-errorreporting.btf.de
