A vulnerability classified as problematic has been found in Microsoft Internet Explorer up to 11 (Web Browser). Affected is an unknown part of the component HTML5 Handler. The manipulation with an unknown input leads to a information exposure vulnerability. CWE is classifying the issue as CWE-203. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality.

The issue has been introduced in 03/22/2001. The weakness was shared 06/05/2014 by Paul Stone with Context Information Security as Pixel Perfect Timing Attacks with HTML5 as confirmed paper (Website). The advisory is shared for download at contextis.com. The vendor cooperated in the coordination of the public release. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1592. The advisory points out:

This paper describes a number of timing attack techniques that can be used by a malicious web page to steal sensitive data from a browser, breaking cross-origin restrictions. The new requestAnimationFrame API can be used to time browser rendering operations and infer sensitive data based on timing data. The first technique allows the browser history to be sniffed by detecting redraw events. The second part of the paper shows how SVG filters are vulnerable to a timing attack that can be used to read pixel values from a web page. This allows pixels from cross-origin iframes to be read using an OCR-style technique to obtain sensitive data from websites.

A public exploit has been developed by Paul Stone in HTML and been published immediately after the advisory. The exploit is shared for download at contextis.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 4823 days. During that time the estimated underground price was around $25k-$100k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Further details are available at arstechnica.com. The entries 13466 and 13465 are related to this item.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Internet Explorer

Version

• 6
• 7
• 8
• 9
• 10
• 11

License

• commercial

Support

• end of life

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion