The vulnerable system is bound to a protocol stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared proximity (e.g., Bluetooth, NFC, or IEEE 802.11) or logical network (e.g., local IP subnet), or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN within an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery flood leading to a denial of service on the local LAN segment (e.g., CVE-2013-6014).
Privileges Required
High
PR
The attacker requires privileges that provide significant (e.g., administrative) control over the vulnerable system allowing full access to the vulnerable system’s settings and files.
Scope
S
An exploited vulnerability can affect resources beyond the security scope managed by the security authority that is managing the vulnerable component. This is often referred to as a 'privilege escalation,' where the attacker can use the exploited vulnerability to gain control of resources that were not intended or authorized.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Perhaps not surprisingly, there appears to be a vulnerability in how
Microsoft Internet Explorer handles (or fails to handle) certain
combinations of nested OBJECT tags. This was tested with MSIE
6.0.2900.2180.xpsp.040806-1825 and mshtml.dll 6.00.2900.2873
xpsp_sp2_gdr.060322-1613.
At first sight, this vulnerability may offer a remote compromise vector,
although not necessarily a reliable one. The error is convoluted and
difficult to debug in absence of sources; as such, I cannot offer a
definitive attack scenario, nor rule out that my initial diagnosis will be
proved wrong [*]. As such, panic, but only slightly.
Probably the easiest way to trigger the problem is as follows:
perl -e '{print "<STYLE></STYLE>n<OBJECT>nBorkn"x32}' >test.html
...this will (usually) cause a NULL pointer + fixed offset (eax+0x28)
dereference in mshtml.dll, the pointer being read from allocated but still
zeroed memory region.
The aforementioned condition is not exploitable, but padding the page with
preceeding OBJECT tag (and other tags), increasing the number of nested
OBJECTs, and most importantly, adding bogus 'type=' parameters of various
length to the final sequence of OBJECTs, will cause that dereference to
become non-NULL on many installations; then, a range of other interesting
faults should ensue, including dereferences of variable bogus addresses
close to stack, or crashes later on, when the page is reloaded or closed.
[ In absence of sources, I do not understand the precise underlying
mechanics of the bug, and I am not inclined to spend hours with a
debugger to find out. I'm simply judging by the symptoms, but these
seem to be indicative of an exploitable flaw. ]
Several examples of pages that cause distinct faults in my setup (your
mileage may and probably WILL vary; on three test machines, this worked as
described; on one, all examples behaved in non-exploitable 0x28 way):
http://lcamtuf.coredump.cx/iedie2-1.html (eax=0x0, instant dereference)
http://lcamtuf.coredump.cx/iedie2-2.html (bogus esi on reload/leave)
http://lcamtuf.coredump.cx/iedie2-3.html (page fault on browser close)
http://lcamtuf.coredump.cx/iedie2-4.html (bogus esi on reload/leave)
Well, that's it. Feel free to research this further. This vulnerability,
as requested by customers, is released in strict observance of the Patch
Wednesday & Bug Saturday policy.
[*] The ability of the attacker to document the attack scenario probably
doesn't matter for those who pretend to care; cryptic "hi" to
Secunia and their standards of conduct.