Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Web Browser)  >   Microsoft Internet Explorer Vendors:   Microsoft
Microsoft Internet Explorer Bug in Processing Nested OBJECT Tags Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016001
SecurityTracker URL:
CVE Reference:   CVE-2006-1992   (Links to External Site)
Updated:  Aug 15 2009
Original Entry Date:  Apr 27 2006
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 6
Description:   A vulnerability was reported in Microsoft Internet Explorer. A remote user can cause arbitrary code to be executed on the target user's system.

The browser does not properly process certain combinations of nested OBJECT tags. A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a NULL pointer dereference and cause the target user's browser to crash or execute arbitrary code.

A demonstration exploit is provided:

perl -e '{print "<STYLE></STYLE>\n<OBJECT>\nBork\n"x32}' >test.html

Impact:   A remote user can cause arbitrary code to be executed on the target user's system.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  [VulnWatch] MSIE (mshtml.dll) OBJECT tag vulnerability

Perhaps not surprisingly, there appears to be a vulnerability in how
Microsoft Internet Explorer handles (or fails to handle) certain
combinations of nested OBJECT tags. This was tested with MSIE
6.0.2900.2180.xpsp.040806-1825 and mshtml.dll 6.00.2900.2873

At first sight, this vulnerability may offer a remote compromise vector,
although not necessarily a reliable one. The error is convoluted and
difficult to debug in absence of sources; as such, I cannot offer a
definitive attack scenario, nor rule out that my initial diagnosis will be
proved wrong [*]. As such, panic, but only slightly.

Probably the easiest way to trigger the problem is as follows:

  perl -e '{print "<STYLE></STYLE>\n<OBJECT>\nBork\n"x32}' >test.html

...this will (usually) cause a NULL pointer + fixed offset (eax+0x28)
dereference in mshtml.dll, the pointer being read from allocated but still
zeroed memory region.

The aforementioned condition is not exploitable, but padding the page with
preceeding OBJECT tag (and other tags), increasing the number of nested
OBJECTs, and most importantly, adding bogus 'type=' parameters of various
length to the final sequence of OBJECTs, will cause that dereference to
become non-NULL on many installations; then, a range of other interesting
faults should ensue, including dereferences of variable bogus addresses
close to stack, or crashes later on, when the page is reloaded or closed.

[ In absence of sources, I do not understand the precise underlying
  mechanics of the bug, and I am not inclined to spend hours with a
  debugger to find out. I'm simply judging by the symptoms, but these
  seem to be indicative of an exploitable flaw. ]

Several examples of pages that cause distinct faults in my setup (your
mileage may and probably WILL vary; on three test machines, this worked as
described; on one, all examples behaved in non-exploitable 0x28 way): (eax=0x0, instant dereference) (bogus esi on reload/leave) (page fault on browser close) (bogus esi on reload/leave)

Well, that's it. Feel free to research this further. This vulnerability,
as requested by customers, is released in strict observance of the Patch
Wednesday & Bug Saturday policy.

[*] The ability of the attacker to document the attack scenario probably
    doesn't matter for those who pretend to care; cryptic "hi" to
    Secunia and their standards of conduct.


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC