Microsoft Internet Explorer服务拒绝漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1108106 漏洞类型 格式化字符串
发布时间 2004-08-04 更新时间 2004-12-31
CVE编号 CVE-2004-2434 CNNVD-ID CNNVD-200412-667
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/376
https://www.securityfocus.com/bid/90401
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-667
|漏洞详情
MicrosoftInternetExplorer6.0SP1版本存在漏洞。远程攻击者可以借助带有"::{"(冒号冒号左大括号)的连接导致服务拒绝(浏览器崩溃)。该漏洞在用户试图保存使用"SaveAs"的连接时以及在InternetExplorer准备带有控制攻击者的格式字符串的错误消息时,触发一个空的解引用。
|漏洞EXP
<center><a href=::%7b>Right Click aOn Me And Click "Save Target As"</a>



// milw0rm.com [2004-08-04]
|受影响的产品
Microsoft Internet Explorer for Unix 6.0 SP1
|参考资料

来源:XF
名称:ie-null-pointer-dos(16420)
链接:http://xforce.iss.net/xforce/xfdb/16420
来源:www.securiteam.com
链接:http://www.securiteam.com/windowsntfocus/5IP020KDPU.html
来源:OSVDB
名称:8335
链接:http://www.osvdb.org/8335
来源:SECTRACK
名称:1010491
链接:http://securitytracker.com/id?1010491
来源:FULLDISC
名称:20040728Re:InternetExplorerRemoteNullPointerCrash(mshtml.dll)
链接:http://archives.neohapsis.com/archives/fulldisclosure/2004-07/1126.html
来源:FULLDISC
名称:20040615RE:InternetExplorerRemoteNullPointerCrash(mshtml.dll)
链接:http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0428.html
来源:FULLDISC
名称:20040614InternetExplorerRemoteNullPointerCrash(mshtml.dll)
链接:http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0397.html