Microsoft Internet Explorer 10 MSHTML GetPlainTextInScope 内存损坏

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
5.8	$5k-$25k	0.00

摘要信息

分类为致命的漏洞曾在Microsoft Internet Explorer 10中发现。受影响的是功能CElement::GetPlainTextInScope的组件:MSHTML Handler。由于被操作，进而引发内存损坏。攻击可能起始于远程，没有现成的漏洞利用。推荐安装补丁来解决该问题。

分类为致命的漏洞曾在Microsoft Internet Explorer 10中发现。受影响的是功能CElement::GetPlainTextInScope的组件:MSHTML Handler。由于被操作，进而引发内存损坏。利用 CWE 标识该问题会跳转到 CWE-119。此漏洞的脆弱性 2016-11-03由公示人Berend-Jan Wever (SkyLined)、公示人身份MSIE 10 MSHTML CElement::GetPlainTextInScope out-of-bounds read、公示人类型为Mailinglist Post (Full-Disclosure)所公布。阅读公告的网址是seclists.org。此公开发布未经过与厂商的协调。

攻击可能起始于远程，技术细节已公开。此漏洞的受欢迎程度低于平均值。没有现成的漏洞利用。当前漏洞利用的价值为美元大约是$5k-$25k 。

如果有长度，则声明为未定义。作为零日漏洞，其地下市场的估计价格约为$25k-$100k。公告指出：

The above suggests that there is limit opportunity for exploiting this issue: it may be possible to determine if a memory block allocated for a string of an attacker controlled size is followed by a memory block that starts with the bytes `0A 00`. To better understand the impact, one would have to get an older version of MSIE 10 and debug the crash. Unfortunately, I did not have time to do so.

推荐安装补丁来解决该问题。