Microsoft Internet Explorer "window()"

*Mobo* · #1 05-31-2005, 12:30 PM

Benjamin Tobias Franz has discovered a weakness in Internet Explorer, which can be exploited by malicious people to cause a DoS (Denial of Service).

The problem is caused due to certain objects not being initialized correctly. This can be exploited to crash a vulnerable browser via some specially crafted JavaScript code called directly when a site has been loaded.

Example:
<body onload="window();">

NOTE: It is currently not believed that this issue can be exploited for code execution purposes, but this cannot be ruled out completely.

The weakness has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2.

Solution:
Disable Active Scripting except for trusted sites.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
hijack log	der	Spyware / Virus Removal	46	10-04-2005 07:49 AM
eliteuvf32.exe?? AdWare?	Alex	Spyware / Virus Removal	31	05-17-2005 09:50 PM
Pop-up crazy	MOJET	Spyware / Virus Removal	11	03-30-2005 09:22 PM
Microsoft Internet Explorer 6	Mobo	Security Alerts and vulnerabilities	0	12-15-2004 08:29 PM
Internet Explorer HTML Elements Buffer Overflow	Mobo	Security Alerts and vulnerabilities	0	12-06-2004 11:32 AM

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)