Sunday, July 14, 2013

How I found CVE-2013-1310 in IE6 and IE7

From http://www.satzansatz.de/cssd/pseudocss.html#fltadjacent:
"Now, when such a .ipsum construct gains "layout" by a subset of layout properties (position: absolute; / float: any value; / display: inline-block; / zoom: 1;), what will happen? Right. Some will have to cancel the frozen process, others will have to reboot, data gets lost. Don't do it. (No, I don't link to a testcase here. IE7b3 is still crashing after scrolling/resizing. Depending on the memory already burned, you might have difficulties to stop the process...)"

I created this test manually (save http://www.satzansatz.de/cssd/pseudocss/pseudocss_t004.html and add zoom: 1 to .ipsum) and not only this bug is still in final IE7, I also noticed that there is also a potentially exploitable crash bug by opening the about box after opening this page. When this happens, it crashes with EIP at an invalid address.

After this, by adding onclick="window.showModalDialog('target.htm')" to <p class="ipsum">, creating the target.htm, then opening the page and clicking inside the box, I triggered various crashes including attempts at executing data (note that IE7 do not enable DEP by default) and heap termination on corruption.

I turned full pageheap on and after I did so it crashes reliably at:

(360.51c): Access violation - code c0000005 (first/second chance not available)
eax=00000004 ebx=08042e78 ecx=0000000a edx=065acfa0 esi=08042e78 edi=065289c0
eip=3ceff096 esp=04d04ba8 ebp=04d04bf8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
mshtml!CLineCore::AssignLine+0x37:
3ceff096 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

MS fixed this bug in the May 2013 Cumulative Update for IE6 and IE7.
Here is http://www.satzansatz.de/cssd/pseudocss/pseudocss_t004.html rendered in IE6 and IE7 before the patch:


After the patch (notice it is the same rendering as IE8+ in IE7 compat mode):

2 comments:

  1. granny people are dogs and scar on the air jordan 5 uk oilet, hey, fine face, nike air jordan 5 retro sale how looks like being stepped on his foot in dog feces it. cheap tooth for nike air jordan 5 retro sale nike air jordan 5 retro sale Really vain, nike air jordan 5 retro sale watching this kid fragile, so Henla fist. outlet, you look at your child climb the wall to see people a tooth, then viciously times than outlet, air jordan 5 uk outlet for cheap glare, his eyes red.

    ReplyDelete
  2. This nike free run australia is not a leaf master it. Long time no see. http://www.nikeplus.com.au cheap stepping away bald dog's feet, nike free run australia Looked up and just went cheap nike free run shoes cheap eyes, surprise, not the enemy does not gather head, how is he. watching chuckled nike free run australia say hello. See prostrate on the nike free run australia ground like a dog bald dog surprised not help.

    ReplyDelete