Vulnerability

VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 "CDisplayPointer" Use-after-free (MS13-028)

VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6
"CDisplayPointer" Use-after-free (MS13-028)

Website : http://www.vupen.com

Twitter : http://twitter.com/vupen




I. BACKGROUND

---------------------

"Microsoft Internet Explorer is a web browser developed by Microsoft and
included as part of the Microsoft Windows line of operating systems with
more than 60% of the worldwide usage share of web browsers." (Wikipedia)


II. DESCRIPTION




III. AFFECTED PRODUCTS
---------------------------

• Microsoft Internet Explorer 10
• Microsoft Internet Explorer 9
• Microsoft Internet Explorer 8
• Microsoft Internet Explorer 7
• Microsoft Internet Explorer 6
  
• Microsoft Windows RT
• Microsoft Windows 8 for 32-bit Systems
• Microsoft Windows 8 for x64-based Systems
• Microsoft Windows Server 2012
• Microsoft Windows 7 for 32-bit Systems
• Microsoft Windows 7 for 32-bit Systems Service Pack 1
• Microsoft Windows 7 for x64-based Systems
• Microsoft Windows 7 for x64-based Systems Service Pack 1
• Microsoft Windows Server 2008 for 32-bit Systems
• Microsoft Windows Server 2008 for 32-bit Systems Service Pack 2
• Microsoft Windows Server 2008 for x64-based
• Microsoft Windows Server 2008 for x64-based Systems Service Pack 2
• Microsoft Windows Server 2008 for Itanium-based Systems
• Microsoft Windows Server 2008 for Itanium-based Systems Service Pack 2
• Microsoft Windows Server 2008 R2 for x64-based Systems
• Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Microsoft Windows Server 2008 R2 for Itanium-based Systems
• Microsoft Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
• Microsoft Windows Vista Service Pack 1
• Microsoft Windows Vista Service Pack 2
• Microsoft Windows Vista x64 Edition Service Pack 1
• Microsoft Windows Vista x64 Edition Service Pack 2
• Microsoft Windows Server 2003 Service Pack 2
• Microsoft Windows Server 2003 x64 Edition Service Pack 2
• Microsoft Windows Server 2003 with SP2 for Itanium-based Systems
• Microsoft Windows XP Service Pack 3
• Microsoft Windows XP Professional x64 Edition Service Pack 2

IV. Binary Analysis & Exploits/PoCs
---------------------------------------

In-depth technical analysis of the vulnerability and a fully functional
remote code execution exploit are available through the VUPEN BAE
(Binary Analysis & Exploits) portal:

click

VUPEN Binary Analysis & Exploits Service provides private exploits and
in-depth technical analysis of the most significant public vulnerabilities
based on disassembly, reverse engineering, protocol analysis, and code
audit.

The service allows governments and major corporations to evaluate risks, and
protect infrastructures and assets against new threats. The service also
allows security vendors (IPS, IDS, AntiVirus) to supplement their internal
research efforts and quickly develop both vulnerability-based and
exploit-based signatures to proactively protect their customers from attacks
and emerging threats.

V. VUPEN Threat Protection Program/
-----------------------------------

Governments and major corporations which are members of the VUPEN Threat
Protection Program (TPP) have been proactively alerted about the
vulnerability
when it was discovered by VUPEN in advance of its public disclosure, and
have received a detailed attack detection guidance to protect national and
critical infrastructures against potential 0-day attacks exploiting this
vulnerability:

click



III. DESCRIPTION
-------------------------
It has been detected than an unprivileged user can write in the local
disk and the local file "lang.tmp" can be modified in the remote machine.

The injection is done through the page "/xampp/lang.php".

IV. PROOF OF CONCEPT
-------------------------
Malicious Request

http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk

And next, if we access to the file:

http://vulnerablesite.com/xampp/lang.tmp

We can verify that the file was modified.



VI. SYSTEMS AFFECTED
-------------------------
XAMPP 1.8.1