Microsoft XML Core Services <= 6.0 SubstringData Integer Overflow Vulnerability

ID SSV:83876
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00


No description provided by source.


Microsoft XML Core Services is prone to an integer-overflow vulnerability because the application fails to ensure that integer values are not overrun.

Attackers can exploit this issue by enticing unsuspecting users to view malicious web content. Specially crafted scripts could issue requests to MSXML that trigger memory corruption.

Successfully exploiting this issue allows remote attackers to corrupt heap memory and execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

//var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
//var txt = xmlDoc.createTextNode("huh");
//var out = txt.substringData(1,0x7fffffff);