[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] CVE-2016-0063: MSIE 8-11 MSHTML DOMImplementation type confusion details
From: Berend-Jan Wever <berendj () nwever ! nl>
Date: 2016-11-28 9:22:20
Message-ID: aed63ec5-ce94-9221-16e2-70c223aa1c6a () nwever ! nl
[Download RAW message or body]
[Attachment #2 (multipart/signed)]
Throughout November, I plan to release details on vulnerabilities I
found in web-browsers which I've not released before. This is the
twentieth entry in that series. Unfortunately I won't be able to
publish everything within one month at the current rate, so I may
continue to publish these through December and January.
The below information is available in more detail on my blog at
http://blog.skylined.nl/20161128001.html. There you can find a repro
that triggered this issue in addition to the information below.
Follow me on http://twitter.com/berendjanwever for daily browser bugs.
MSIE 8-11 MSHTML DOMImplementation type confusion
=================================================
(MS16-009, CVE-2016-0063)
Synopsis
--------
A specially crafted web-page can cause a type confusion vulnerability in
Microsoft Internet Explorer 8 through to 11. An attacker can cause code
to be executed with a stack layout it does not expect, or have code
attempt to execute a method of an object using a vftable, when that
object does not have a vftable. Successful exploitation can lead to
arbitrary code execution.
Known affected software and attack vectors
------------------------------------------
+ Microsoft Internet Explorer 8, 9, 10 and 11
An attacker would need to get a target user to open a specially
crafted web-page. Disabling Javascript should prevent an attacker
from triggering the vulnerable code path.
Description
-----------
I identified two attack vectors to this vulnerability. One of them is
that Javascript can make a copy of the `hasFeature` method of a
`DOMImplementation` object in one window and use it as a method of
another object in another window. Doing so can cause at least two issues
in the `MSHTML!Method_VARIANTBOOLp_BSTR_o0oVARIANT` function of MSIE:
* A FailFast exception when the code detects that calling a method of
an object has not cleaned up the stack as expected; this is because
the called function appears to expect a different number of arguments
or a different calling convention. This issue can be triggered by
changing the line `o.x();` in the repro to `o.x(new Array)`.
* An out-of-bounds write when `MSHTML!CBase::PrivateGetDispID` is
called; this is probably caused by a type confusion bug: the code
expects a `VARIANT` object of one type, but is working on an object
of a different type.
Exploitation of this attack vector was not attempted. I reversed
`Method_VARIANTBOOLp_BSTR_o0oVARIANT` only sufficiently to get an idea
of the root cause, but not enough to determine exactly what is going on
or how to control the issue for command execution.
Another attack vector is calling the `isPrototypeOf` method of the
`DOMImplementation` interface as a function: this results in type
confusion where a C++ object is assumed to implement `IUnknown` when in
fact it does not. The code attempts to call the `IUnknown::Release`
method, expecting a vftable to be stored at offset 0, but since the
object has no vftables, a member property is stored at this offset,
which appears to have a static value `002dc6c0`. An attacker that is
able to control this value, or allocate memory and store data at that
address, may be able to execute arbitrary code.
No attempts were made to further reverse the code and determine the
exact root cause. A few attempts were made to control the value at
offset 0 of the object in question, as well as get another object in its
place with a different value at this location, but both efforts were
brief and unsuccessful.
Time-line
---------
* September 2015: This vulnerability was found through fuzzing.
* October 2015: This vulnerability was submitted to ZDI.
* November 2015: This vulnerability was acquired by ZDI.
* February 2016: This issue was addressed by Microsoft in MS16-009.
* November 2016: Details of this issue are released.
Cheers,
SkyLined
["0x2557C5AA.asc" (application/pgp-keys)]
["signature.asc" (signature.asc)]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJYO/dMAAoJEJ0drYglV8Wqn7AQAJIm/SfAQ4gwSu10WC0Q1HAC
S4vyZQgw27IS86tblkJ8MDGy2qxAJy5OeL7FdWynv3cdSwu8gXUSrNFHWXOCofCG
r1vBc74v7GubsAL5kUxnXa0np5Cj6032QMWy/D0QQLL8VdwZZC9sHUktiu6wOeOU
jWRlsvQ0LZNzW1sWICCOIAOToYbq9kYWzA3R30502vrzraxZ2AmYlzBILMviPRRU
pD/3Px3alMtSymXk3IGu4hLjko1pUyHbVz3UbMFaEgcSsKor/uI3X96u6pH5MtIG
zGO89T1BZIrrsD+o1gr0PzqNIMs5XwVXy0ZJtLSCay84sC4klnH+WW0j7NTY/dNQ
aBHs1rIC0ggZLTNFbZ16Jg53xfipSpuIm21cloNP7EAz4Rah9Uv++GrrpVVsa8FR
Jb2Mav9pkemZG2P0EGb3NJXAwqslCjKzAXTfzaxYfKwDNLx2A7PA6AGVft3DTnDq
i1AEupjlxTCVw0QieizLQLvCgqnzm2Fh9/sOAQU2WyyhoNhLprG5C8ZmmUl8Sk7J
L1FLAdPX0IEHpV7k7hSHx+wEr12Y6omoEYIeq+80Uk4do68SwW381ysCdH0bFCY7
6tmirWqSVRLHXbW0IahOd8Lzj9fD42AGGRkIdcOGnwR/rB7P9ue2hOoLHEv8/G7N
ehlezkrsZt8Q4xKlXdVa
=GVc6
-----END PGP SIGNATURE-----
--Fu8RGLreKIP2hvaVfLVpssRONGosxPVVw--
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic