"Cutting to the chase, VBScript permits in-place resizing of arrays through the command “redim preserve.” This is where the vulnerability is.
redim preserve arrayname( newsizeinelements )
...
For VBScript, exploitation of this bug could have been avoided by invalidating the common “On Error Resume Next” VBScript code when the OleAut32 library returns with an error."
Always thought there was something shady about VB and redimming -- and On Error Resume Next. ;^) But that explains why it's as old as VB itself.
redim preserve arrayname( newsizeinelements ) ... For VBScript, exploitation of this bug could have been avoided by invalidating the common “On Error Resume Next” VBScript code when the OleAut32 library returns with an error."
Always thought there was something shady about VB and redimming -- and On Error Resume Next. ;^) But that explains why it's as old as VB itself.