Re: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability

Perhaps not surprisingly, there appears to be a vulnerability in
Microsoft Internet Explorer handles (or fails to handle) certain
combinations of nested OBJECT tags. This was tested with MSIE
6.0.2900.2180.xpsp.040806-1825 and mshtml.dll 6.00.2900.2873

At first sight, this vulnerability may offer a remote compromise
although not necessarily a reliable one. The error is convoluted
difficult to debug in absence of sources; as such, I cannot offer
definitive attack scenario, nor rule out that my initial
diagnosis will be
proved wrong [*]. As such, panic, but only slightly.

Probably the easiest way to trigger the problem is as follows:

perl -e '{print "<STYLE></STYLE>\n<OBJECT>\nBork\n"x32}'

...this will (usually) cause a NULL pointer + fixed offset
dereference in mshtml.dll, the pointer being read from allocated
but still
zeroed memory region.

The aforementioned condition is not exploitable, but padding the
page with
preceeding OBJECT tag (and other tags), increasing the number of
OBJECTs, and most importantly, adding bogus 'type=' parameters of
length to the final sequence of OBJECTs, will cause that
dereference to
become non-NULL on many installations; then, a range of other
faults should ensue, including dereferences of variable bogus
close to stack, or crashes later on, when the page is reloaded or

[ In absence of sources, I do not understand the precise
mechanics of the bug, and I am not inclined to spend hours with
debugger to find out. I'm simply judging by the symptoms, but
seem to be indicative of an exploitable flaw. ]

Several examples of pages that cause distinct faults in my setup
mileage may and probably WILL vary; on three test machines, this
worked as
described; on one, all examples behaved in non-exploitable 0x28
way): (eax=0x0, instant
dereference) (bogus esi on
reload/leave) (page fault on browser
close) (bogus esi on

Well, that's it. Feel free to research this further. This
as requested by customers, is released in strict observance of
the Patch
Wednesday & Bug Saturday policy.

[*] The ability of the attacker to document the attack scenario
doesn't matter for those who pretend to care; cryptic "hi" to
Secunia and their standards of conduct.
Sir, You work very well! I think you must also pester Microsoft. I
also remember LSD pesters Microsoft and they were rapidly sold out.

Concerned about your privacy? Instantly send FREE secure email, no account required

Get the best prices on SSL certificates from Hushmail

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Relevant Pages