Dear xxxx (at) gmail (dot) com [email concealed],

NULL pointer dereference is not exploitable to code execution by itself.
Please read carefully original Michal Zalewski post on the issue you are
pointing
http://securitytracker.com/alerts/2006/Apr/1016001.html

issue mentioned is not NULL pointer, but NULL+offset dereference where
offset is believed to be controlled:

-=-=-=-=- start quote Michal Zalewski =-=-=-=-

...this will (usually) cause a NULL pointer + fixed offset (eax+0x28)
dereference in mshtml.dll, the pointer being read from allocated but still
zeroed memory region.

The aforementioned condition is not exploitable, but padding the page with
preceeding OBJECT tag (and other tags), increasing the number of nested
OBJECTs, and most importantly, adding bogus 'type=' parameters of various
length to the final sequence of OBJECTs, will cause that dereference to
become non-NULL on many installations;

-=-=-=-=- end quote =-=-=-=-

--Tuesday, October 31, 2006, 11:00:00 PM, you wrote to bugtraq (at) securityfocus (dot) com [email concealed]:

xgc> When you have a NULL pointer dereference a code execution is
xgc> also possible, so you can't exclude it at all.
xgc> For example in this old flaw:
xgc> http://securitytracker.com/alerts/2006/Apr/1016001.html
xgc> "The browser does not properly process certain combinations
xgc> of nested OBJECT tags. A remote user can create specially crafted
xgc> HTML that, when loaded by the target user, will trigger a NULL
xgc> pointer dereference and cause the target user's browser to crash or
xgc> execute arbitrary code."

--
~/ZARAZA
http://www.security.nnov.ru/

[ reply ]