[Full-disclosure] Microsoft Windows default ZIP handler bug

[Kristian Erik Hermansen]

I tested this on three Windows XP machines and was able to make them
all crash.  There is an issue with the way Microsoft's default
compressed file handler deals with embedded compressed files.  I don't
have much time to investigate further, since I am in Atlanta all this
week for SPICON and don't have any tools on my corp laptop :-(
However, I put together a Flash video showing the bug.  It may not be
exploitable, but I also haven't been keeping up with the latest bad
pointer / alternate code path research stuff.  Maybe someone can do
some ninjitsu code exec using this...

Video:
http://kristian-hermansen.com/hacks/microsoft-windows-default-compressed-file-handler-crasher-2.swf

File:
http://kristian-hermansen.com/hacks/IIIIIIIIJJJJJJJJKKKKKKKKLLLLLLLL.zip
-- 
Kristian Erik Hermansen