TUCoPS :: Browsers :: msie4fno.txt

Another MSIE 4.0 filename overflow

Date: Fri, 20 Mar 1998 12:09:46 +0200
From: Georgi Guninski <guninski@hotmail.com>
Subject: MSIE buffer overrun

Microsoft Internet Explorer 4.0 (don't know for other versions)
can be crashed and eventually made execute arbitrary code
with a little help of the <EMBED> tag.

The following:
<EMBED SRC=file://C|/A.ABOUT_200_CHARACTERS_HERE___________________>
opens a dialog box and closes IE 4.0.
It seems that the long file extension causes stack overrun.

The stack is smashed - full with our values, EIP is also ours and CS=SS.
So probably a string could be constructed, executing code at the
client's machine.

Solution: Do not browse hostile pages.
To try this: http://www.geocities.com/ResearchTriangle/1711/msie.html

Georgi Guninski

-----------------------cut here and save as
Trying to crash IE 4.0
80                                                                               160                    170                 180                 190          200

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH