Dear xxxx@xxxxxxxxx, NULL pointer dereference is not exploitable to code execution by itself. Please read carefully original Michal Zalewski post on the issue you are pointing http://securitytracker.com/alerts/2006/Apr/1016001.html issue mentioned is not NULL pointer, but NULL+offset dereference where offset is believed to be controlled: -=-=-=-=- start quote Michal Zalewski =-=-=-=- ...this will (usually) cause a NULL pointer + fixed offset (eax+0x28) dereference in mshtml.dll, the pointer being read from allocated but still zeroed memory region. The aforementioned condition is not exploitable, but padding the page with preceeding OBJECT tag (and other tags), increasing the number of nested OBJECTs, and most importantly, adding bogus 'type=' parameters of various length to the final sequence of OBJECTs, will cause that dereference to become non-NULL on many installations; -=-=-=-=- end quote =-=-=-=- --Tuesday, October 31, 2006, 11:00:00 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx: xgc> When you have a NULL pointer dereference a code execution is xgc> also possible, so you can't exclude it at all. xgc> For example in this old flaw: xgc> http://securitytracker.com/alerts/2006/Apr/1016001.html xgc> "The browser does not properly process certain combinations xgc> of nested OBJECT tags. A remote user can create specially crafted xgc> HTML that, when loaded by the target user, will trigger a NULL xgc> pointer dereference and cause the target user's browser to crash or xgc> execute arbitrary code." -- ~/ZARAZA http://www.security.nnov.ru/
