PT-2008-6040 · Microsoft · Internet Explorer

Muts · Publicado 2008-12-11 · Atualizado 2018-10-12 · CVE-2008-4844

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 through 7

Description The issue is related to a use-after-free vulnerability in the CRecordInstance::TransferToDestination function, allowing remote attackers to execute arbitrary code via crafted HTML or XML documents. This can be achieved through DSO bindings involving XML Island, XML DSOs, or Tabular Data Control (TDC), as demonstrated by nested SPAN or MARQUEE elements. The vulnerability was exploited in the wild in December 2008. It is also described as an invalid pointer reference in the data binding function, which can cause Internet Explorer to exit unexpectedly and potentially allow remote code execution when a user views a specially crafted Web page.

Recommendations For Microsoft Internet Explorer versions 5.01 through 7, consider disabling data binding as a temporary workaround until a patch is available. Restrict access to potentially vulnerable components, such as XML Island, XML DSOs, or Tabular Data Control (TDC), to minimize the risk of exploitation. Avoid using nested SPAN or MARQUEE elements in HTML or XML documents until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-4844

Produtos afetados

Internet Explorer

Referências · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms08_078_xml_corruption.rb · Exploit
• 🔥 https://exploit-db.com/exploits/7583 · Exploit
• 🔥 https://exploit-db.com/exploits/7403 · Exploit
• 🔥 http://isc.sans.org/diary.html?storyid=5458 · Exploit
• 🔥 https://exploit-db.com/exploits/7410 · Exploit
• 🔥 https://exploit-db.com/exploits/16583 · Exploit
• 🔥 https://exploit-db.com/exploits/7477 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4844 · Nota de Segurança
• http://code.google.com/p/inception-h2hc · Nota
• http://vupen.com/english/advisories/2008/3391 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=123015308222620&w=2 · Aviso do Fabricante
• http://breakingpointsystems.com/community/blog/patch-tuesdays-and-drive-by-sundays · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6007 · Nota
• http://avertlabs.com/research/blog/index.php/2008/12/09/yet-another-unpatched-drive-by-exploit-found-on-the-web · Nota
• http://securityfocus.com/bid/32721 · Nota