|
|
Multiple Microsoft Internet Explorer Script Execution Vulnerabilities
Liu Die Yu has developed a proof of concept exploit to demonstrate arbitrary code execution using a combination of unpatched Internet Explorer vulnerabilities. Successful exploitation of these vulnerabilities combines results in the execution of a cached executable file supplied by an attacker. The issues known to be exploited in cobmination the issue described in this BID (specifically the WsOpenFileJPU bug), are described in the following BIDs: BID 8980 - Microsoft Internet Explorer Double Slash Cache Zone Bypass Vulnerability BID 8886 - Microsoft Internet Explorer Local Resource Reference Vulnerability BID 3779 - Microsoft Internet Explorer JavaScript Local File Enumeration Vulnerability The exploit can be obtained by visiting the following demo page provided by Liu Die Yu or by downloading execdror5-Demo.zip below. http://www.safecenter.net/UMBRELLAWEBV4/execdror5/execdror5-MyPage.htm *** The ADODB.Stream Object exploit that was previously mentioned in this BID has been assigned its own BID (10514). Please refer to that BID for further information. |
|
Privacy Statement |