CVE-2014-0322
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
Analysis
Internet Explorer 9 and 10 contain a use-after-free vulnerability in CMarkup object handling exploitable via crafted JavaScript, used in 'Operation SnowMan' watering hole attacks targeting US military and defense in early 2014.
Technical Context
The CWE-416 use-after-free is triggered through a sequence of JavaScript operations involving CMarkup objects and onpropertychange event handlers. By creating and destroying DOM elements in a specific pattern, the attacker causes a CMarkup object to be freed while still referenced, then uses heap spray to control the freed memory.
Affected Products
['Microsoft Internet Explorer 9', 'Microsoft Internet Explorer 10']
Remediation
Migrate to modern browsers. Apply Microsoft security update MS14-012. This was a key driver in the industry's push to deprecate legacy IE versions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today