Vulnerabilities > CVE-2010-3962 - Use After Free vulnerability in Microsoft Internet Explorer 6/7/8

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

microsoft

CWE-416

critical

nessus

exploit available

metasploit

NVD

Published: 2010-11-05

Updated: 2022-02-28

Summary

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

Vulnerable Configurations

Part	Description	Count
Application	Microsoft Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8	3
OS	Microsoft Microsoft Windows Server 2003 - Microsoft Windows XP - Microsoft Windows Server 2008 - Microsoft Windows Server 2008 R2 Microsoft Windows Vista - Microsoft Windows 7 -	10

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Exploit-Db

description	Microsoft Internet Explorer Memory - Corruption Vulnerability (0day). CVE-2010-3962. Dos exploit for windows platform
file	exploits/windows/dos/15418.html
id	EDB-ID:15418
last seen	2016-02-01
modified	2010-11-04
platform	windows
port
published	2010-11-04
reporter	Unknown
source	https://www.exploit-db.com/download/15418/
title	Microsoft Internet Explorer Memory - Corruption Vulnerability 0day
type	dos

description	Internet Explorer CSS SetUserClip Memory Corruption. CVE-2010-3962. Remote exploit for windows platform
id	EDB-ID:16551
last seen	2016-02-02
modified	2011-01-20
published	2011-01-20
reporter	metasploit
source	https://www.exploit-db.com/download/16551/
title	Microsoft Internet Explorer - CSS SetUserClip Memory Corruption

description	Internet Explorer 6, 7 and 8 Memory Corruption 0day Exploit CVE-2010-3962. CVE-2010-3962. Remote exploit for windows platform
file	exploits/windows/remote/15421.html
id	EDB-ID:15421
last seen	2016-02-01
modified	2010-11-04
platform	windows
port
published	2010-11-04
reporter	ryujin
source	https://www.exploit-db.com/download/15421/
title	Microsoft Internet Explorer 6/7/8 - Memory Corruption Exploit 0day
type	remote

Metasploit

description	This module exploits a memory corruption vulnerability within Microsoft's HTML engine (mshtml). When parsing an HTML page containing a specially crafted CSS tag, memory corruption occurs that can lead arbitrary code execution. It seems like Microsoft code inadvertently increments a vtable pointer to point to an unaligned address within the vtable's function pointers. This leads to the program counter being set to the address determined by the address "[vtable+0x30+1]". The particular address depends on the exact version of the mshtml library in use. Since the address depends on the version of mshtml, some versions may not be exploitable. Specifically, those ending up with a program counter value within another module, in kernel space, or just not able to be reached with various memory spraying techniques. Also, since the address is not controllable, it is unlikely to be possible to use ROP to bypass non-executable memory protections.
id	MSF:EXPLOIT/WINDOWS/BROWSER/MS10_090_IE_CSS_CLIP
last seen	2020-04-11
modified	2019-05-23
published	2010-12-14
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3962
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
title	MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption

Msbulletin

bulletin_id	MS10-090
bulletin_url
date	2010-12-14T00:00:00
impact	Remote Code Execution
knowledgebase_id	2416400
knowledgebase_url
severity	Critical
title	Cumulative Security Update for Internet Explorer

Nessus

NASL family	Windows : Microsoft Bulletins
NASL id	SMB_NT_MS10-090.NASL
description	The remote host is missing Internet Explorer (IE) Security Update 2416400. The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host.
last seen	2020-06-01
modified	2020-06-02
plugin id	51162
published	2010-12-15
reporter	This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/51162
title	MS10-090: Cumulative Security Update for Internet Explorer (2416400)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(51162); script_version("1.29"); script_cvs_date("Date: 2018/11/15 20:50:30"); script_cve_id( "CVE-2010-3340", "CVE-2010-3342", "CVE-2010-3343", "CVE-2010-3345", "CVE-2010-3346", "CVE-2010-3348", "CVE-2010-3962" ); script_bugtraq_id( 44536, 45255, 45256, 45259, 45260, 45261, 45263 ); script_xref(name:"CERT", value:"899748"); script_xref(name:"EDB-ID", value:"15421"); script_xref(name:"EDB-ID", value:"15418"); script_xref(name:"MSFT", value:"MS10-090"); script_xref(name:"MSKB", value:"2416400"); script_name(english:"MS10-090: Cumulative Security Update for Internet Explorer (2416400)"); script_summary(english:"Checks version of Mshtml.dll"); script_set_attribute( attribute:"synopsis", value: "Arbitrary code can be executed on the remote host through a web browser." ); script_set_attribute( attribute:"description", value: "The remote host is missing Internet Explorer (IE) Security Update 2416400. The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host." ); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-090"); script_set_attribute( attribute:"solution", value: "Microsoft has released a set of patches for XP, 2003, Vista, 2008, 7, and 2008 R2." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploithub_sku", value:"EH-13-157"); script_set_attribute(attribute:"exploit_framework_exploithub", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_set_attribute(attribute:"vuln_publication_date", value:"2010/11/03"); script_set_attribute(attribute:"patch_publication_date", value:"2010/12/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/12/15"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc."); script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, 'Host/patch_management_checks'); exit(0); } include("audit.inc"); include("smb_func.inc"); include("smb_hotfixes.inc"); include("smb_hotfixes_fcheck.inc"); include("misc_func.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS10-090'; kbs = make_list("2416400"); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE); get_kb_item_or_exit("SMB/Registry/Enumerated"); get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1); if (hotfix_check_sp_range(xp:'3', win2003:'2', vista:'1,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN); if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE); rootfile = hotfix_get_systemroot(); if (!rootfile) exit(1, "Failed to get the system root."); share = hotfix_path2share(path:rootfile); if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share); kb = "2416400"; if ( # Windows 7 and Windows Server 2008 R2 # # - Internet Explorer 8 hotfix_is_vulnerable(os:"6.1", file:"Mshtml.dll", version:"8.0.7600.20831", min_version:"8.0.7600.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.1", file:"Mshtml.dll", version:"8.0.7600.16700", min_version:"8.0.7600.16000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Vista / Windows 2008 # # - Internet Explorer 8 hotfix_is_vulnerable(os:"6.0", file:"Mshtml.dll", version:"8.0.6001.23091", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", file:"Mshtml.dll", version:"8.0.6001.18999", min_version:"8.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 7 hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.22511", min_version:"7.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.18332", min_version:"7.0.6002.18000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.22784", min_version:"7.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.18542", min_version:"7.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Windows 2003 / XP 64-bit # # - Internet Explorer 8 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"8.0.6001.18999", min_version:"8.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 7 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.17093", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 6 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"6.0.3790.4795", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Windows XP x86 # # - Internet Explorer 8 hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"8.0.6001.18999", min_version:"8.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 7 hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"7.0.6000.17093", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 6 hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"6.0.2900.6049", min_version:"6.0.2900.0", dir:"\system32", bulletin:bulletin, kb:kb) ) { set_kb_item(name:"SMB/Missing/MS10-090", value:TRUE); hotfix_security_hole(); hotfix_check_fversion_end(); exit(0); } else { hotfix_check_fversion_end(); audit(AUDIT_HOST_NOT, 'affected'); }

Oval

accepted

2014-08-18T04:00:23.331-04:00

class

vulnerability

contributors

name Josh Turpin
organization Symantec Corporation
name Sharath S
organization SecPod Technologies
name Dragos Prisaca
organization Symantec Corporation
name Maria Mikhno
organization ALTX-SOFT
name Maria Mikhno
organization ALTX-SOFT

definition_extensions

comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Windows Server 2003 (ia64) Gold is installed
oval oval:org.mitre.oval:def:396
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Windows Server 2003 (ia64) Gold is installed
oval oval:org.mitre.oval:def:396
comment Microsoft Internet Explorer 7 is installed
oval oval:org.mitre.oval:def:627
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356
comment Microsoft Windows Server 2008 (ia-64) is installed
oval oval:org.mitre.oval:def:5667
comment Microsoft Internet Explorer 7 is installed
oval oval:org.mitre.oval:def:627
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356
comment Microsoft Windows Server 2008 (ia-64) is installed
oval oval:org.mitre.oval:def:5667
comment Microsoft Internet Explorer 7 is installed
oval oval:org.mitre.oval:def:627
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Internet Explorer 8 is installed
oval oval:org.mitre.oval:def:6210
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356
comment Microsoft Internet Explorer 8 is installed
oval oval:org.mitre.oval:def:6210
comment Microsoft Windows 7 (32-bit) is installed
oval oval:org.mitre.oval:def:6165
comment Microsoft Windows 7 x64 Edition is installed
oval oval:org.mitre.oval:def:5950
comment Microsoft Windows Server 2008 R2 x64 Edition is installed
oval oval:org.mitre.oval:def:6438
comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
oval oval:org.mitre.oval:def:5954
comment Microsoft Internet Explorer 8 is installed
oval oval:org.mitre.oval:def:6210

description

family

windows

oval:org.mitre.oval:def:12279

status

accepted

submitted

2010-10-12T13:00:00

title

Uninitialized Memory Corruption Vulnerability

version

Packetstorm

data source	https://packetstormsecurity.com/files/download/95516/ie678-corrupt.txt
id	PACKETSTORM:95516
last seen	2016-12-05
published	2010-11-05
reporter	Matteo Memelli
source	https://packetstormsecurity.com/files/95516/Microsoft-Internet-Explorer-6-7-8-Memory-Corruption.html
title	Microsoft Internet Explorer 6 / 7 / 8 Memory Corruption

data source	https://packetstormsecurity.com/files/download/95522/ms10_xxx_ie_css_clip.rb.txt
id	PACKETSTORM:95522
last seen	2016-12-05
published	2010-11-05
reporter	Matteo Memelli
source	https://packetstormsecurity.com/files/95522/Internet-Explorer-CSS-Tags-Memory-Corruption.html
title	Internet Explorer CSS Tags Memory Corruption

data source	https://packetstormsecurity.com/files/download/96706/ms10_090_ie_css_clip.rb.txt
id	PACKETSTORM:96706
last seen	2016-12-05
published	2010-12-14
reporter	Matteo Memelli
source	https://packetstormsecurity.com/files/96706/Internet-Explorer-CSS-SetUserClip-Memory-Corruption.html
title	Internet Explorer CSS SetUserClip Memory Corruption

Saint

bid	44536
description	Internet Explorer CSS clip attribute memory corruption
id	win_patch_ie_v6,win_patch_ie_v7,win_patch_ie_v8
osvdb	68987
title	ie_css_clip
type	client

Seebug

bulletinFamily	exploit
description	No description provided by source.
id	SSV:20230
last seen	2017-11-19
modified	2010-11-05
published	2010-11-05
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-20230
title	Internet Explorer 6, 7, 8 Memory Corruption 0day Exploit

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Exploit-Db

Metasploit

Msbulletin

Nessus

Oval

Packetstorm

Saint

Seebug

References