MSIE screen[""] NULL ptr DoS details

Posted by SkyLined on January 7th, 2009 in , , and · 2 Comments

MSIE can be made to crash with a NULL ptr Read AV by executing a very small piece of JavaScript. This affects MSIE 6.0, 7.0 and 8.0 beta2…

List of software vulnerabilities

Posted by SkyLined on January 5th, 2009 in · 0 Comments

I have created a list of software vulnerabilities, including previously unreleased material, on the wiki:

http://skypher.com/wiki/index.php?title=List_of_software_vulnerabilities

I’ll update it as I find more issues and fixes become available.

Safari arguments integer overflow PoC (CVE-2008-2303)

Posted by SkyLined on January 5th, 2009 in , , and · 1 Comment

CVE-2008-2303 covers an integer overflow in the handling of indices in the “arguments” array in Apple Safari that affects iPhone, iPod and PC (Mac and Windows). It was fixed in Safari 3.2 for iPhone and iPod in July and for PC in November…

Cmd.exe explorer integration

Posted by SkyLined on January 5th, 2009 in · 0 Comments

You can start a cmd.exe command prompt in any subdirectory by right clicking it and slecting “cmd.exe” by adding the following to your registry:

Create the key “HKEY_CLASSES_ROOT\Folder\shell\cmd.exe\command“ and set the default value to a REG_EXPAND_SZ with this value:

“%SystemRoot%\system32\cmd.exe” /K PUSHD “%1″ & TITLE CMD.EXE %1
 

Here’s an example .reg file to do this, which can be downloaded here:

Windows Registry Editor Version 5.00
 
[HKEY_CLASSES_ROOT\Folder\shell\cmd.exe]
 
[HKEY_CLASSES_ROOT\Folder\shell\cmd.exe\command]
@=hex(2):22,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,63,\
00,6d,00,64,00,2e,00,65,00,78,00,65,00,22,00,20,00,2f,00,4b,00,20,00,50,00,\
55,00,53,00,48,00,44,00,20,00,22,00,25,00,31,00,22,00,20,00,26,00,20,00,54,\
00,49,00,54,00,4c,00,45,00,20,00,43,00,4d,00,44,00,2e,00,45,00,58,00,45,00,\
20,00,25,00,31,00,00,00
 

Also, in Windows Vista and newer versions, if you hold down the left shift key while right clicking on a folder, you get an extra menu item “Open Command Window Here” even without applying this registry change.

WinDbg explorer integration

Posted by SkyLined on January 5th, 2009 in and · 2 Comments

You can execute any .exe file (and link to .exe file, with arguments) running under WinDbg by right clicking it and selecting “WinDbg” by adding the following to your registry:

Create the key “HKEY_CLASSES_ROOT\exefile\shell\WinDbg\command” and set the default value to a REG_EXPAND_SZ with this value:

“%ProgramFiles%\Debugging Tools for Windows (x64)\windbg.exe” -o -W [Your workspace] “%1″ %*
 

-or-

“%ProgramFiles%\Debugging Tools for Windows (x86)\windbg.exe” -o -W[Your workspace] ”%1″ %*
 

(Choose the  x64 or x86 version depending on your OS)…