Microsoft Internet Explorer CSSText加粗字体服务拒绝漏洞-安全小百科

Microsoft Internet Explorer CSSText加粗字体服务拒绝漏洞

漏洞ID	1106807	漏洞类型	设计错误
发布时间	2002-06-15	更新时间	2005-10-20
CVE编号	CVE-2002-1705	CNNVD-ID	CNNVD-200212-592
漏洞平台	Windows	CVSS评分	5.0

|漏洞来源

https://www.exploit-db.com/exploits/21556
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-592

|漏洞详情

MicrosoftInternetExplorer5.5至6.0版本存在漏洞。远程攻击者可以借助带p{cssText}元素声明和加粗字体磅数的层叠样式表(CSS)导致服务拒绝（崩溃）。

|漏洞EXP

source: http://www.securityfocus.com/bid/5027/info

A problem with Microsoft Internet Explorer may make it possible to deny service to users of the browser. The problem is in the handling of certain types of stylesheet input.

It may be possible to crash IE. When IE encounters a style sheet with the p{cssText} element declared, and a font weight of bold is specified, the browser crashes. This could be used as a denial of service attack.


<style>p{cssText: font-weight: bold;}</style>

|参考资料

来源:XF
名称:ie-css-bold-dos(9367)
链接:http://xforce.iss.net/xforce/xfdb/9367
来源:BID
名称:5027
链接:http://www.securityfocus.com/bid/5027

相关推荐: COM2001 InternetPBX Alexis 漏洞

COM2001 InternetPBX Alexis 漏洞漏洞ID 1205259 漏洞类型未知发布时间 2001-09-27 更新时间 2001-09-27 CVE编号 CVE-2001-1253 CNNVD-ID CNNVD-200109-131 漏…

文章版权归作者所有，未经允许请勿转载。

THE END