what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-98223

Microsoft Internet Explorer COALineDashStyleArray Unsafe Memory Access

Posted Nov 26, 2013

Authored by Vitaliy Toropov, juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module exploits a vulnerability on Microsoft Silverlight. The vulnerability exists on the Initialize() method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code (user controlled) it's possible to dereference arbitrary memory which easily leverages to arbitrary code execution. In order to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class from System.Windows.dll. This Metasploit module has been tested successfully on IE6 - IE10, Windows XP SP3 / Windows 7 SP1 on both x32 and x64 architectures.

tags | exploit, arbitrary, code execution, bug bounty, packet storm

systems | windows

advisories | CVE-2013-0074, CVE-2013-3896, OSVDB-91147, OSVDB-98223

SHA-256 | 3905f49c6a63195a8b150b72b89466bf89d932607328806dbfade7ebf03e25ce

Download | Favorite | View