Vulnerable:  Microsoft Internet Explorer 6.0
- Microsoft Windows 2000 Advanced Server SP2
- Microsoft Windows 2000 Advanced Server SP1
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server SP2
- Microsoft Windows 2000 Datacenter Server SP1
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows 2000 Professional SP2
- Microsoft Windows 2000 Professional SP1
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server SP2
- Microsoft Windows 2000 Server SP1
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Terminal Services SP2
- Microsoft Windows 2000 Terminal Services SP1
- Microsoft Windows 2000 Terminal Services
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows ME
- Microsoft Windows NT Enterprise Server 4.0 SP6a
- Microsoft Windows NT Server 4.0 SP6a
- Microsoft Windows NT Workstation 4.0 SP6a
+ Microsoft Windows Server 2003 Datacenter Edition
+ Microsoft Windows Server 2003 Datacenter Edition 64-bit
+ Microsoft Windows Server 2003 Enterprise Edition
+ Microsoft Windows Server 2003 Enterprise Edition 64-bit
+ Microsoft Windows Server 2003 Standard Edition
+ Microsoft Windows Server 2003 Web Edition
+ Microsoft Windows XP Home
+ Microsoft Windows XP Professional 


Microsoft Internet Explorer is affected by a denial-of-service vulnerability. This issue arises because the application fails to handle exceptional conditions in a proper manner.

An attacker may exploit this issue by enticing a user to visit a malicious site, resulting in a denial-of-service condition in the application.

This issue results in a NULL-pointer dereference, causing the application to crash. If attackers can manipulate the pointer being dereferenced, code execution may be possible. Note that this has not been confirmed.

Since exploiting this issue requires only standard HTML, it may not be easily mitigated.

Internet Explorer 6 is vulnerable to this issue; other versions may also be affected.

Exploit:

The following HTML content is sufficient to trigger this issue:

<applet><h4><title> </title><base>

Solution:
Currently we are not aware of any vendor-supplied patches for this issue.

Fuente: www.securityfocus.com

mmm.. talves pueda modificar el exploit del de OBJECT para adecuarse a este, chequen la sección de herramientas y utilidades, puse una nueva para atacar TAGS en IExplorer, hay q debuggear un poco, pero se podria hacer un exploit para este bug.. si encontramos la llamada..
voy a ver que encuentro.

Saludos!!

Entonces ser vulnerable dependera de si tienes java o no instalado en el sistema...

pues... todas las combinaciones producen el mismo resultado... llego a la conclusion de que hasta que alguien pruebe lo contrario, no es posible hacer un BoF con este bug.

Saludos!!