Description
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (browser crash) via a link with "::{" (colon colon left brace), which triggers a null dereference when the user attempts to save the link using "Save As" and Internet Explorer prepares an error message with an attacker-controlled format string.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Internet Explorer - 'mshtml.dll' Remote Null Pointer Crash EDB-376 · dos · Aug 4, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 8335 vdb-entry
- 1010491 vdb-entry
- 20040615 RE: Internet Explorer Remote Null Pointer Crash(mshtml.dll) mailing-list
- 20040728 Re: Internet Explorer Remote Null Pointer Crash(mshtml.dll) mailing-list
- 20040614 Internet Explorer Remote Null Pointer Crash(mshtml.dll) mailing-list
- ie-null-pointer-dos(16420) vdb-entry
- http://www.securiteam.com/windowsntfocus/5IP020KDPU.html