Microsoft Internet Explorer 8 CGenericElement object use-after-free vulnerability

Overview

Microsoft Internet Explorer 8 contains a use-after-free vulnerability in the CGenericElement object, which is currently being exploited in the wild.

Description

Microsoft Security Advisory 2847140 states:

Internet Explorer 6, Internet Explorer 7, Internet Explorer 9, and Internet Explorer 10 are not affected by the vulnerability.

This is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

Additional details may be found in the full advisory. A Metasploit module has been released to exploit this vulnerability as well.

---

Impact

A remote unauthenticated attacker may be able to run arbitrary code in the context of the user running Internet Explorer 8.

---

Solution

Apply an Update

Microsoft has released MS13-038 to address this vulnerability. The patch may be obtain through Microsoft’s Windows Update.

If you are unable to upgrade, please consider the following workarounds.

---

Apply a Microsoft “Fix It”

Microsoft has released a Microsoft “Fix It” solution for this vulnerability. The “Fix It” solution uses the Windows application compatibility toolkit to make a small change at runtime to mshtml.dll every time IE is loaded.

Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will. While still in beta, EMET 4.0 provides additional exploit mitigations that EMET 3.0 does not that will increase the difficulty of exploitation for an adversary.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

---

Vendor Information

237655

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation Affected

Updated: May 06, 2013

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://technet.microsoft.com/en-us/security/advisory/2847140&gt;

CVSS Metrics

Group	Score	Vector
Base	9.4	AV:N/AC:L/Au:N/C:C/I:C/A:N
Temporal	8.9	E:H/RL:W/RC:C
Environmental	6.7	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <https://technet.microsoft.com/en-us/security/bulletin/ms13-038&gt;
• <http://blogs.technet.com/b/srd/archive/2013/05/08/microsoft-quot-fix-it-quot-available-to-mitigate-internet-explorer-8-vulnerability.aspx&gt;
• <http://technet.microsoft.com/en-us/security/advisory/2847140&gt;
• <http://blogs.technet.com/b/msrc/archive/2013/05/03/microsoft-releases-security-advisory-2847140.aspx&gt;
• <https://community.rapid7.com/community/metasploit/blog/2013/05/05/department-of-labor-ie-0day-now-available-at-metasploit&gt;
• <http://dev.metasploit.com/redmine/projects/framework/repository/revisions/a33510e82135355548a529e5f0cb5ab7134d674d/entry/modules/exploits/windows/browser/ie_cgenericelement_uaf.rb&gt;
• <http://labs.alienvault.com/labs/index.php/2013/u-s-department-of-labor-website-hacked-and-redirecting-to-malicious-code/&gt;

Acknowledgements

This vulnerability was discovered in the wild.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2013-1347
Date Public:	2013-05-03 Date First Published: