Memory corruption vulnerability caused by CSS exceptions in ie7.0

 

# Ghost doll:

It is estimated that many of you have seen it. Someone sent it from the past two days. These two days are a little busy, so you don't have to worry about updating them.

Thanks to friddy.

.

1. Vulnerability Introduction

Under the XHTML 1.0 standard, a special CSS style is used to open a specific webpage in Internet Explorer 7.0.
Explorer 7.0 will crash in memory, and the EIP pointer will access the memory area near 0x70613e5b. If you overwrite the special machine code near 0x70613e5bAttackers can execute arbitrary commands.

2. hazards (hazard levelHigh

)

If hackers exploit the vulnerabilityProgramThe web page is placed on the website, and the client that browses the Web page containing the vulnerability exploitation program will be running a Trojan horse.

3. Notification Channels

Submitted to the national vulnerability library.

4. Download detailed documents

PoC:

Click to view PoC: yxlink_sec_ie7_poc.txt