Vulnerabilities > CVE-2012-1876 - Code Injection vulnerability in Microsoft Internet Explorer

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

microsoft

CWE-94

nessus

exploit available

metasploit

NVD

Published: 2012-06-12

Updated: 2023-12-07

Summary

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

Vulnerable Configurations

Part	Description	Count
Application	Microsoft Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 Microsoft Internet Explorer 9	4
OS	Microsoft Microsoft Windows 2003 Server * Microsoft Windows Server 2003 * Microsoft Windows XP * Microsoft Windows XP - Microsoft Windows Server 2008 * Microsoft Windows Server 2008 - Microsoft Windows Server 2008 R2 Microsoft Windows Vista * Microsoft Windows Vista - Microsoft Windows 7 * Microsoft Windows 7 -	18

Common Weakness Enumeration (CWE)

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.

Exploit-Db

description	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.1 Bypass (MS12-037). CVE-2012-1876. Remote exploit for windows platform
id	EDB-ID:35273
last seen	2016-02-04
modified	2014-11-17
published	2014-11-17
reporter	ryujin & sickness
source	https://www.exploit-db.com/download/35273/
title	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.1 Bypass MS12-037

description	Microsoft Internet Explorer Fixed Table Col Span Heap Overflow. CVE-2012-1876. Remote exploit for windows platform
id	EDB-ID:20174
last seen	2016-02-02
modified	2012-08-02
published	2012-08-02
reporter	metasploit
source	https://www.exploit-db.com/download/20174/
title	Microsoft Internet Explorer Fixed Table Col Span Heap Overflow

description	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR & DEP Bypass (MS12-037). CVE-2012-1876. Remote exploit for windows platform
id	EDB-ID:24017
last seen	2016-02-02
modified	2013-01-10
published	2013-01-10
reporter	sickness
source	https://www.exploit-db.com/download/24017/
title	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR & DEP Bypass MS12-037

description	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037). CVE-2012-1876. Remote exploit for windows platform
id	EDB-ID:34815
last seen	2016-02-03
modified	2014-09-29
published	2014-09-29
reporter	ryujin & sickness
source	https://www.exploit-db.com/download/34815/
title	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass MS12-037

description	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 4.1.x Bypass (MS12-037). CVE-2012-1876. Remote exploit for windows platform
id	EDB-ID:33944
last seen	2016-02-03
modified	2014-07-01
published	2014-07-01
reporter	sickness
source	https://www.exploit-db.com/download/33944/
title	Microsoft Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 4.1.x Bypass MS12-037

Metasploit

description	This module exploits a heap overflow vulnerability in Internet Explorer caused by an incorrect handling of the span attribute for col elements from a fixed table, when they are modified dynamically by javascript code.
id	MSF:EXPLOIT/WINDOWS/BROWSER/MS12_037_IE_COLSPAN
last seen	2020-06-13
modified	2017-10-05
published	2012-07-31
references	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1876
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/ms12_037_ie_colspan.rb
title	MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow

Msbulletin

bulletin_id	MS12-037
bulletin_url
date	2012-06-12T00:00:00
impact	Remote Code Execution
knowledgebase_id	2699988
knowledgebase_url
severity	Critical
title	Cumulative Security Update for Internet Explorer

Nessus

NASL family	Windows : Microsoft Bulletins
NASL id	SMB_NT_MS12-037.NASL
description	The remote host is missing Internet Explorer (IE) Security Update 2699988. The installed version of IE is affected by several vulnerabilities that could allow an attacker to execute arbitrary code on the remote host.
last seen	2020-06-01
modified	2020-06-02
plugin id	59455
published	2012-06-13
reporter	This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/59455
title	MS12-037: Cumulative Security Update for Internet Explorer (2699988)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(59455); script_version("1.31"); script_cvs_date("Date: 2018/11/15 20:50:31"); script_cve_id( "CVE-2012-1523", "CVE-2012-1858", "CVE-2012-1872", "CVE-2012-1873", "CVE-2012-1874", "CVE-2012-1875", "CVE-2012-1876", "CVE-2012-1877", "CVE-2012-1878", "CVE-2012-1879", "CVE-2012-1880", "CVE-2012-1881", "CVE-2012-1882" ); script_bugtraq_id( 53841, 53842, 53843, 53844, 53845, 53847, 53848, 53866, 53867, 53868, 53869, 53870, 53871 ); script_xref(name:"EDB-ID", value:"19777"); script_xref(name:"EDB-ID", value:"20174"); script_xref(name:"EDB-ID", value:"24017"); script_xref(name:"EDB-ID", value:"33944"); script_xref(name:"EDB-ID", value:"35815"); script_xref(name:"MSFT", value:"MS12-037"); script_xref(name:"MSKB", value:"2699988"); script_name(english:"MS12-037: Cumulative Security Update for Internet Explorer (2699988)"); script_summary(english:"Checks version of Mshtml.dll"); script_set_attribute(attribute:"synopsis", value:"The remote host is affected by code execution vulnerabilities."); script_set_attribute(attribute:"description", value: "The remote host is missing Internet Explorer (IE) Security Update 2699988. The installed version of IE is affected by several vulnerabilities that could allow an attacker to execute arbitrary code on the remote host."); # http://blog.watchfire.com/wfblog/2012/07/tostatichtml-the-second-encounter-cve-2012-1858-html-sanitizing-information-disclosure-introduction-t.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c7d49512"); # http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?18c6adba"); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-12-093/"); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-12-190/"); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-12-192/"); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-12-193/"); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-12-194/"); script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/523185/30/0/threaded"); script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/523186/30/0/threaded"); script_set_attribute(attribute:"see_also", value:"https://www.securityfocus.com/archive/1/523196/30/0/threaded"); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2012/ms12-037"); script_set_attribute(attribute:"solution", value: "Microsoft has released a set of patches for XP, 2003, Vista, 2008, 7, and 2008 R2."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_set_attribute(attribute:"vuln_publication_date", value:"2012/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2012/06/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/13"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:ie"); script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc."); script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, "Host/patch_management_checks"); exit(0); } include("audit.inc"); include("smb_func.inc"); include("smb_hotfixes.inc"); include("smb_hotfixes_fcheck.inc"); include("misc_func.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS12-037'; kb = '2699988'; kbs = make_list(kb); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE); get_kb_item_or_exit("SMB/Registry/Enumerated"); get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1); if (hotfix_check_sp_range(xp:'3', win2003:'2', vista:'2', win7:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN); if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE); rootfile = hotfix_get_systemroot(); if (!rootfile) exit(1, "Failed to get the system root."); share = hotfix_path2share(path:rootfile); if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share); if ( # Windows 7 / 2008 R2 # # - Internet Explorer 9 hotfix_is_vulnerable(os:"6.1", file:"Mshtml.dll", version:"9.0.8112.20551", min_version:"9.0.8112.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.1", file:"Mshtml.dll", version:"9.0.8112.16446", min_version:"9.0.8112.16000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 8 hotfix_is_vulnerable(os:"6.1", sp:1, file:"Mshtml.dll", version:"8.0.7601.21976", min_version:"8.0.7601.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.1", sp:1, file:"Mshtml.dll", version:"8.0.7601.17824", min_version:"8.0.7601.17000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.1", sp:0, file:"Mshtml.dll", version:"8.0.7600.21198", min_version:"8.0.7600.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.1", sp:0, file:"Mshtml.dll", version:"8.0.7600.17006", min_version:"8.0.7600.16000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Vista / 2008 # # - Internet Explorer 9 hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"9.0.8112.20551", min_version:"9.0.8112.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"9.0.8112.16446", min_version:"9.0.8112.16000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 8 hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"8.0.6001.23359", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"8.0.6001.19272", min_version:"8.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 7 hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.22838", min_version:"7.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.18616", min_version:"7.0.6002.18000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Windows 2003 / XP 64-bit # # - Internet Explorer 8 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"8.0.6001.23345", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"8.0.6001.19258", min_version:"8.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 7 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.21312", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.17110", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 6 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"6.0.3790.4986", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Windows XP x86 # # - Internet Explorer 8 hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"8.0.6001.23345", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"8.0.6001.19258", min_version:"8.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 7 hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"7.0.6000.21312", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"7.0.6000.17110", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # - Internet Explorer 6 hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"6.0.2900.6212", min_version:"6.0.2900.0", dir:"\system32", bulletin:bulletin, kb:kb) ) { set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE); hotfix_security_hole(); hotfix_check_fversion_end(); exit(0); } else { hotfix_check_fversion_end(); audit(AUDIT_HOST_NOT, 'affected'); }

Oval

accepted

2014-08-18T04:01:17.563-04:00

class

vulnerability

contributors

name SecPod Team
organization SecPod Technologies
name Maria Mikhno
organization ALTX-SOFT

definition_extensions

comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Windows Server 2003 (ia64) Gold is installed
oval oval:org.mitre.oval:def:396
comment Microsoft Internet Explorer 7 is installed
oval oval:org.mitre.oval:def:627
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Windows Server 2003 (ia64) Gold is installed
oval oval:org.mitre.oval:def:396
comment Microsoft Internet Explorer 8 is installed
oval oval:org.mitre.oval:def:6210
comment Microsoft Windows XP (32-bit) is installed
oval oval:org.mitre.oval:def:1353
comment Microsoft Windows Server 2003 (32-bit) is installed
oval oval:org.mitre.oval:def:1870
comment Microsoft Windows Server 2003 (x64) is installed
oval oval:org.mitre.oval:def:730
comment Microsoft Windows XP x64 is installed
oval oval:org.mitre.oval:def:15247
comment Microsoft Internet Explorer 7 is installed
oval oval:org.mitre.oval:def:627
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356
comment Microsoft Windows Server 2008 (ia-64) is installed
oval oval:org.mitre.oval:def:5667
comment Microsoft Internet Explorer 8 is installed
oval oval:org.mitre.oval:def:6210
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows Server 2008 (32-bit) is installed
oval oval:org.mitre.oval:def:4870
comment Microsoft Windows Server 2008 (64-bit) is installed
oval oval:org.mitre.oval:def:5356
comment Microsoft Windows 7 is installed
oval oval:org.mitre.oval:def:12541
comment Microsoft Windows Server 2008 R2 x64 Edition is installed
oval oval:org.mitre.oval:def:6438
comment Microsoft Windows Vista (32-bit) is installed
oval oval:org.mitre.oval:def:1282
comment Microsoft Windows Vista x64 Edition is installed
oval oval:org.mitre.oval:def:2041
comment Microsoft Windows 7 (32-bit) is installed
oval oval:org.mitre.oval:def:6165
comment Microsoft Windows 7 x64 Edition is installed
oval oval:org.mitre.oval:def:5950
comment Microsoft Internet Explorer 9 is installed
oval oval:org.mitre.oval:def:11985
comment Microsoft Internet Explorer 8 is installed
oval oval:org.mitre.oval:def:6210
comment Microsoft Windows 7 is installed
oval oval:org.mitre.oval:def:12541
comment Microsoft Windows Server 2008 R2 x64 Edition is installed
oval oval:org.mitre.oval:def:6438
comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
oval oval:org.mitre.oval:def:5954
comment Microsoft Windows Server 2008 R2 x64 Edition is installed
oval oval:org.mitre.oval:def:6438
comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
oval oval:org.mitre.oval:def:5954
comment Microsoft Windows 7 (32-bit) is installed
oval oval:org.mitre.oval:def:6165
comment Microsoft Windows 7 x64 Edition is installed
oval oval:org.mitre.oval:def:5950

description

family

windows

oval:org.mitre.oval:def:15539

status

accepted

submitted

2012-06-18T09:20:00

title

Col Element Remote Code Execution Vulnerability (CVE-2012-1876)

version

Packetstorm

data source	https://packetstormsecurity.com/files/download/119467/ie8fixedcol-overflow.txt
id	PACKETSTORM:119467
last seen	2016-12-05
published	2013-01-11
reporter	sickness
source	https://packetstormsecurity.com/files/119467/Internet-Explorer-8-Heap-Overflow.html
title	Internet Explorer 8 Heap Overflow

data source	https://packetstormsecurity.com/files/download/128476/ie8-bypass.txt
id	PACKETSTORM:128476
last seen	2016-12-05
published	2014-09-29
reporter	sickness
source	https://packetstormsecurity.com/files/128476/Internet-Explorer-8-Fixed-Col-Span-ID-Full-ASLR-DEP-And-EMET-5.0-Bypass.html
title	Internet Explorer 8 Fixed Col Span ID Full ASLR, DEP, And EMET 5.0 Bypass

data source	https://packetstormsecurity.com/files/download/127316/iecolspan-bypass.txt
id	PACKETSTORM:127316
last seen	2016-12-05
published	2014-07-01
reporter	sickness
source	https://packetstormsecurity.com/files/127316/Internet-Explorer-8-Bypass.html
title	Internet Explorer 8 Bypass

data source	https://packetstormsecurity.com/files/download/115155/ms12_037_ie_colspan.rb.txt
id	PACKETSTORM:115155
last seen	2016-12-05
published	2012-08-01
reporter	Alexandre Pelletier
source	https://packetstormsecurity.com/files/115155/Microsoft-Internet-Explorer-Fixed-Table-Col-Span-Heap-Overflow.html
title	Microsoft Internet Explorer Fixed Table Col Span Heap Overflow

Saint

bid	53848
description	Internet Explorer COL SPAN Heap Overflow
id	win_patch_ie_v8
osvdb	82866
title	ie_col_span_heap_overflow
type	client

Seebug

bulletinFamily	exploit
description	No description provided by source.
id	SSV:74062
last seen	2017-11-19
modified	2014-07-01
published	2014-07-01
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-74062
title	Microsoft Internet Explorer Fixed Table Col Span Heap Overflow

bulletinFamily	exploit
description	No description provided by source.
id	SSV:60566
last seen	2017-11-19
modified	2013-01-10
published	2013-01-10
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-60566
title	Internet Explorer 8 Fixed Col Span ID full ASLR & DEP bypass

bulletinFamily	exploit
description	No description provided by source.
id	SSV:87309
last seen	2017-11-19
modified	2014-10-10
published	2014-10-10
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-87309
title	Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 5.0 Bypass (MS12-037)

bulletinFamily	exploit
description	No description provided by source.
id	SSV:87111
last seen	2017-11-19
modified	2014-07-02
published	2014-07-02
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-87111
title	Internet Explorer 8 - Fixed Col Span ID Full ASLR, DEP & EMET 4.1.X Bypass

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Metasploit

Msbulletin

Nessus

Oval

Packetstorm

Saint

Seebug

References