Listen to this Post
The CVE-2013-3918 vulnerability exists within the `InformationCardSigninHelper` ActiveX control (icardie.dll). The flaw is an out-of-bounds write memory corruption issue. When a victim using a vulnerable Windows system visits a maliciously crafted webpage with Internet Explorer, the page instantiates the vulnerable ActiveX control. By passing specific, unexpected parameters to the control’s methods, an attacker can trigger a memory write operation that occurs outside the bounds of the intended buffer. This corrupts the process memory in a way that can be carefully manipulated to overwrite critical data structures. Ultimately, this allows the attacker to achieve remote code execution with the same privileges as the current user, enabling them to install programs, view/change data, or create new accounts.
Platform: Windows
Version: XP SP3+
Vulnerability: Memory Corruption
Severity: Critical
date: 2013-11-11
Prediction: 2013-12-10
What Undercode Say:
reg query "HKCR\CLSID{c2c4f00a-720e-4389-aeb9-e9c4b0d93c6f}" /s
<object classid='clsid:c2c4f00a-720e-4389-aeb9-e9c4b0d93c6f' id='target'></object>
target.Init(); // Trigger vulnerable method
How Exploit:
Malicious website hosts crafted HTML/JS.
Script accesses ActiveX control.
Out-of-bounds write corrupts memory.
Arbitrary code execution achieved.
Protection from this CVE
Apply MS13-090 patch.
Disable ActiveX control.
Use EMET.
Update Internet Explorer.
Impact:
Remote Code Execution
System Compromise
Denial of Service
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
