Microsoft Internet Explorer Use After Free Vulnerability
13 Aug. 2009
Summary
HTML+TIME (HTML Timed Interactive Multimedia Extensions)is a web standard that was created for Microsoft Corp.'s Internet Explorer (IE) to allow web page authors to create timed animation content on a web page. This is accomplished using an XML like markup that makes use of HTML+TIME properties and elements. Internet Explorer supports this markup standard, and also exposes a scripting interface for interacting with the HTML+TIME elements on the page. Remote exploitation of a use after free vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code with the privileges of the current user.
Vulnerable Systems:
* Microsoft Internet Explorer version 6
* Microsoft Internet Explorer version 7
* Microsoft Internet Explorer version 8
Immune Systems:
* Microsoft Internet Explorer 5
The vulnerability occurs when the 'ondatasetcomplete' event method of a timeChildren object is referenced. If this occurs when the object is in an inconsistent state, a heap chunk will be freed, and then reused after being freed. This results in an uninitialized VTABLE being used, which can result in the execution of arbitrary code when the pointer is dereferenced.
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the user viewing the web page. To exploit this vulnerability, a targeted user must load a malicious web page created by an attacker. An attacker typically accomplishes this via social engineering or injecting content into compromised, trusted sites. After the user visits the malicious web page, no further user interaction is needed.
Disclosure Timeline:
05/06/2009 - PoC Requested
06/06/2009 - PoC Sent
06/24/2009 - Tentative disclosure set to August
06/25/2009 - Requested CVE from vendor
06/25/2009 - Received CVE from vendor
07/23/2009 - Received updated disclosure notice for OOB in July
07/28/2009 - Coordinated public disclosure
--------------------------------------------------------------------------------------------------------------------------------
Evaluate your site's resistance to the installation of malicious code. Have it scanned for vulnerabilities.
