PT-2008-6040 · Microsoft · Internet Explorer

Muts · Published 2008-12-11 · Updated 2018-10-12 · CVE-2008-4844

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 through 7

Description The issue is related to a use-after-free vulnerability in the CRecordInstance::TransferToDestination function, allowing remote attackers to execute arbitrary code via crafted HTML or XML documents. This can be achieved through DSO bindings involving XML Island, XML DSOs, or Tabular Data Control (TDC), as demonstrated by nested SPAN or MARQUEE elements. The vulnerability was exploited in the wild in December 2008. It is also described as an invalid pointer reference in the data binding function, which can cause Internet Explorer to exit unexpectedly and potentially allow remote code execution when a user views a specially crafted Web page.

Recommendations For Microsoft Internet Explorer versions 5.01 through 7, consider disabling data binding as a temporary workaround until a patch is available. Restrict access to potentially vulnerable components, such as XML Island, XML DSOs, or Tabular Data Control (TDC), to minimize the risk of exploitation. Avoid using nested SPAN or MARQUEE elements in HTML or XML documents until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-4844

Affected Products

Internet Explorer

References · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms08_078_xml_corruption.rb · Exploit
• 🔥 https://exploit-db.com/exploits/7583 · Exploit
• 🔥 https://exploit-db.com/exploits/7403 · Exploit
• 🔥 http://isc.sans.org/diary.html?storyid=5458 · Exploit
• 🔥 https://exploit-db.com/exploits/7410 · Exploit
• 🔥 https://exploit-db.com/exploits/16583 · Exploit
• 🔥 https://exploit-db.com/exploits/7477 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4844 · Security Note
• http://vupen.com/english/advisories/2008/3391 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=123015308222620&w=2 · Vendor Advisory
• http://secunia.com/advisories/33089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4844 · Security Note
• http://microsoft.com/technet/security/advisory/961051.mspx · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-078 · Vendor Advisory
• http://code.google.com/p/inception-h2hc · Note