PT-2013-4723 · Microsoft · Internet Explorer+1

Yoshihiro Ishikawa · Published 2013-09-18 · Updated 2025-08-13 · CVE-2013-3893

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 11

Description A use-after-free issue in the SetMouseCapture implementation in mshtml.dll allows remote attackers to execute arbitrary code via crafted JavaScript strings. This could corrupt memory, enabling an attacker to execute arbitrary code in the context of the current user. There have been real-world incidents where this issue was exploited, including attacks by the APT17 group targeting national companies and government institutions with the 9002 RAT malware. The attacks involved phishing lures that tricked recipients into downloading a malicious Skype for Business installer, which then executed a Java archive file to launch the 9002 RAT. The 9002 RAT has features such as network traffic monitoring, screenshot creation, file scanning, process management, and executing additional commands received from the command and control server.

Recommendations For Microsoft Internet Explorer versions 6 through 11, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling JavaScript execution in Internet Explorer until a patch is available. Restrict access to suspicious links and attachments to minimize the risk of exploitation. Avoid using links from untrusted sources, especially those that prompt for the installation of software.

Exploit

Fix

RCE

Use After Free

Weakness Enumeration

CWE-399

CWE-416

Related Identifiers

CVE-2013-3893

Affected Products

Internet Explorer

Skype For Business

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb · Exploit
• 🔥 https://exploit-db.com/exploits/28682 · Exploit
• 🔥 http://blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx · Exploit
• 🔥 https://exploit-db.com/exploits/49872 · Exploit
• 🔥 http://pastebin.com/raw.php?i=Hx1L5gu6 · Exploit
• http://technet.microsoft.com/security/advisory/2887505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3893 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3893 · Security Note
• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18665 · Note
• https://t.me/cveNotify/131981 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3893 · Note
• http://packetstormsecurity.com/files/162585/Microsoft-Internet-Explorer-8-SetMouseCapture-Use-After-Free.html · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-080 · Note