"IE seems to have problems handling Cascading Style Sheet (CSS) elements and therefore an attacker can easily crash IE by using the following, imho, weird combinations of CSS elements:
<STYLE>@;/*
There you go, 11 bytes is all it takes to crash IE. Having <STYLE>@;/*
alone is enough, other HTML tags are not necessary."
http://www.ecqurity.com/adv/IEstyle.html
-
Follow
Oops, something didn't work.
Sign In to be begin to follow this thread
What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in. You need to be signed in to Channel 9 to use this feature.Getting "follow" information
Start following this thread
What does this mean?
Following an item on Channel 9 allows you to watch for new content and comments that you are interested in and view them all on your notifications page.Removing your "follow"
Setting up your "follow"
Did you know you can
sign up for email notifications?
-
-
manickernel
anticipate consequences..
Hey Cool!!
Let's all go back to IE5!
Or all keep hammering it and sending in those error reports...
Generate Error Report
-
Dang! It killed my keyboard settings. Now I have US keyboard for some strange reason. Well curiosity killed the cat I guess.
-
barogers
Come On Fhqwhgads!
Heh. My virus scanner complained at me about the InvCSS trojan, but IE still went down.
-
barogers wrote:Heh. My virus scanner complained at me about the InvCSS trojan, but IE still went down.
On my system, McAfee won't even let the file be written with that content in it or allow me to browse to a page with it.
-
Karim
Trapped in a world he never made!
Hmmm. NOD32 has no problems with the file. IE crashes just fine, even in XP SP2 RC2. Chomp chomp.
I'm looking forward to the spin from the MS security folks on this one. Perhaps it be will called "a vast improvement in robustness compared to previous versions of IE" (which could be crashed with only 7 bytes)?
Or perhaps we'll be told it's not a "critical" issue because it requires "significant interaction" from the user. (Like clicking on a link.) <insert eyerolling emoticon>
Or maybe we'll be told that this problem doesn't exist in Longhorn... which we can all have (at considerable cost) in a year... or two... but two years tops. Yeah, Longhorn, it's gonna be so secure, it's not even FUNNY. Trust us.
Thread Closed
This thread is kinda stale and has been closed but if you'd like to continue the conversation, please create a new thread in our Forums,
or Contact Us and let us know.