Microsoft Internet Explorer 6/7/8 mshtml.dll CDwnBindInfo resource management

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
8.1$0-$5k0.00

Summaryinfo

A vulnerability has been found in Microsoft Internet Explorer 6/7/8 and classified as critical. Affected by this vulnerability is the function CDwnBindInfo in the library mshtml.dll. Performing a manipulation results in resource management. This vulnerability is reported as CVE-2012-4792. The attack is possible to be carried out remotely. Moreover, an exploit is present. This vulnerability is considered historic because of its background and reception. A worm is in circulation, automatically exploiting this vulnerability. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Microsoft Internet Explorer 6/7/8 (Web Browser). This affects the function CDwnBindInfo in the library mshtml.dll. The manipulation with an unknown input leads to a resource management vulnerability. CWE is classifying the issue as CWE-399. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

The bug was discovered 12/26/2012. The weakness was disclosed 12/27/2012 by Bill Gertz with 0-day as Chinese Hackers Suspected in Cyber Attack on Council on Foreign Relations as confirmed article (Website) via Washington Free Beacon. It is possible to read the advisory at freebeacon.com. The vendor was not involved in the public release. This vulnerability is uniquely identified as CVE-2012-4792 since 09/06/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/22/2026). It is expected to see the exploit prices for this product decreasing in the near future.Due to its background and reception, this vulnerability has a historic impact. FireEye provides an interesting insight how the APT was approached: "The initial JavaScript hosting the exploit has some interesting features. To start, it appears the JavaScript only served the exploit to browsers whose language was either English (U.S.), Chinese (China), Chinese (Taiwan), Japanese, Korean, or Russian. Also, the exploit used browser cookies to ensure that the exploit is only delivered once for every user."

A public exploit has been developed by Juan Vazquez in Ruby and been published 3 days after the advisory. The exploit is shared for download at dev.metasploit.com. It is declared as attacked. The vulnerability was handled as a non-public zero-day exploit for at least 4298 days. During that time the estimated underground price was around $5k-$25k. A worm is spreading, which is automatically exploiting this vulnerability. By approaching the search of inurl:/js/js/news_123432476.html it is possible to find vulnerable targets with Google Hacking. The vulnerability scanner Nessus provides a plugin with the ID 63372 (MS KB2794220: Vulnerability in Internet Explorer Could Allow Remote Code Execution (deprecated)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows. The commercial vulnerability scanner Qualys is able to test this issue with plugin 100134 (Microsoft Internet Explorer Remote Code Execution Vulnerability (MS13-008 and KB2794220)). The IE zero-day flaw first came to light after report surfaced that the Council on Foreign Relations (CFR) had been hacked. A closer look by security firm FireEye led to the discovery that the CFR site had been compromised and was hosting malicious content as early as on December 21. Through Malware Protection Cloud, FireEye could confirm that the website was compromised as early as Friday, December 21. A similar Internet Explorer vulnerability was behind the major Aurora cyber attack on Google and other U.S. corporations that began in 2009 and was traced to China’s government.The CISA Known Exploited Vulnerabilities Catalog lists this issue since 07/23/2024 with a due date of 08/13/2024:

The impacted product is end-of-life and should be disconnected if still in use.

Upgrading to version 9 or 10 eliminates this vulnerability. The upgrade is hosted for download at windows.microsoft.com. Applying the patch Fix It 50971 is able to eliminate this problem. The bugfix is ready for download at blogs.technet.com. The problem might be mitigated by replacing the product with Mozilla Firefox, Microsoft Internet Explorer or Opera as an alternative. The best possible mitigation is suggested to be upgrading to the latest version. A possible mitigation has been published 3 weeks after the disclosure of the vulnerability. The article contains the following remark:

We are actively investigating reports of a small, targeted issue affecting Internet Explorer 6-8. […] We will take appropriate action to help keep customers protected once our analysis is complete. People using Internet Explorer 9-10 are not impacted.
Microsoft made a Fix It available for the unpatched vulnerability. A Fix It is not a patch, but an easy method to apply workaround configuration changes. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 12710.

The vulnerability is also documented in the databases at X-Force (80885), Exploit-DB (23785), Zero-Day.cz (50), Tenable (63372) and SecurityFocus (BID 57070†). Further details are available at blog.fireeye.com. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

Vendor

Name

Version

License

Support

Website

CPE 2.3info

CPE 2.2info

Video

Open Video | Show More Videos

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 8.2
VulDB Meta Temp Score: 8.1

VulDB Base Score: 6.3
VulDB Temp Score: 6.0
VulDB Vector: 🔍
VulDB Reliability: 🔍

NVD Base Score: 8.8
NVD Vector: 🔍

CNA Base Score: 8.8
CNA Vector: 🔍

ADP CISA Base Score: 8.8
ADP CISA Vector: 🔍

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Exploitinginfo

Class: Resource management
CWE: CWE-399 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍

Physical: No
Local: No
Remote: Yes

Availability: 🔍
Access: Public
Status: Attacked
Author: Juan Vazquez
Wormified: 🔍
Programming Language: 🔍
Download: 🔍
Google Hack: 🔍

EPSS Score: 🔍
EPSS Percentile: 🔍

KEV Added: 🔍
KEV Due: 🔍
KEV Remediation: 🔍
KEV Ransomware: 🔍
KEV Notice: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Nessus ID: 63372
Nessus Name: MS KB2794220: Vulnerability in Internet Explorer Could Allow Remote Code Execution (deprecated)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍

OpenVAS ID: 902699
OpenVAS Name: Microsoft Internet Explorer Remote Code Execution Vulnerability (2794220)
OpenVAS File: 🔍
OpenVAS Family: 🔍

Saint ID: exploit_info/ie_cbutton_uaf
Saint Name: Internet Explorer CButton Use After Free Vulnerability

Qualys ID: 🔍
Qualys Name: 🔍

MetaSploit ID: ie_cbutton_uaf.rb
MetaSploit Name: MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability
MetaSploit File: 🔍

Exploit-DB: 🔍
Zero-Day.cz: 🔍

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍

Upgrade: Internet Explorer 9/10
Patch: Fix It 50971
Alternative: Mozilla Firefox/Microsoft Internet Explorer/Opera
Suricata ID: 2016132
Suricata Class: 🔍
Suricata Message: 🔍

TippingPoint: 🔍

McAfee IPS: 🔍
McAfee IPS Version: 🔍

ISS Proventia IPS: 🔍
PaloAlto IPS: 🔍
Fortigate IPS: 🔍

Timelineinfo

03/22/2001 🔍
09/06/2012 +4186 days 🔍
12/26/2012 +111 days 🔍
12/27/2012 +1 days 🔍
12/29/2012 +1 days 🔍
12/29/2012 +0 days 🔍
12/29/2012 +0 days 🔍
12/30/2012 +0 days 🔍
12/30/2012 +0 days 🔍
12/30/2012 +0 days 🔍
12/30/2012 +0 days 🔍
12/30/2012 +0 days 🔍
01/02/2013 +3 days 🔍
01/14/2013 +12 days 🔍
04/22/2026 +4846 days 🔍

Sourcesinfo

Vendor: microsoft.com

Advisory: Chinese Hackers Suspected in Cyber Attack on Council on Foreign Relations
Researcher: Bill Gertz
Organization: 0-day
Status: Confirmed
Confirmation: 🔍

CVE: CVE-2012-4792 (🔍)
GCVE (CVE): GCVE-0-2012-4792
GCVE (VulDB): GCVE-100-7227

OVAL: 🔍

CERT: 🔍
X-Force: 80885 - Microsoft Internet Explorer CDwnBindInfo code execution, High Risk
SecurityFocus: 57070 - Microsoft Internet Explorer 'CDwnBindInfo' Use-After-Free Remote Code Execution Vulnerability
Secunia: 51695 - Microsoft Internet Explorer "CDwnBindInfo" Use-After-Free Vulnerability, Extremely Critical
OSVDB: 88774 - Microsoft IE CDwnBindInfo Object Handling Use-after-free Arbitrary Code Execution
SecurityTracker: 1027930 - Microsoft Internet Explorer CDwnBindInfo Object Reuse Flaw Lets Remote Users Execute Arbitrary Code
Vulnerability Center: 37870 - [MS13-008] Microsoft Internet Explorer 6-8 Use-After-Free Vulnerability Allows Remote Code Execution, Critical

scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍

Entryinfo

Created: 12/30/2012 04:04
Updated: 04/22/2026 11:49
Changes: 12/30/2012 04:04 (85), 04/07/2017 12:02 (48), 04/20/2021 13:54 (8), 04/20/2021 13:59 (1), 06/13/2024 22:32 (15), 07/14/2024 16:53 (4), 07/23/2024 18:38 (9), 07/24/2024 03:35 (1), 08/01/2024 16:05 (11), 08/14/2024 18:44 (11), 09/09/2024 22:30 (1), 12/29/2024 20:23 (2), 01/26/2025 19:52 (1), 04/22/2026 11:49 (11)
Complete: 🔍
Cache ID: 216::103

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Might our Artificial Intelligence support you?

Check our Alexa App!