MS IE Uninitialized DOM Memory Corruption (Dec 11, 2009)

Microsoft Internet Explorer version 8, the latest version to date, contains a memory corruption vulnerability. The flaw exists due to an inproper handling of script modified DOM structures.

DOM defines an object oriented structure of the HTML document content. It allows for individual elements and properties of the HTML document to be manipulated by script. In the DOM structure, all HTML tags and their attributes are stored in a tree-like structure as Nodes. This tree can be defined statically using HTML tags or dynamically using script.

An example HTML code snippet followed by its DOM represenation is shown:

DOM representation:

html |- body | |- p

DOM objects can be modified dynamically by script embedded in the HTML document. An example of dynamic DOM manipulation is shown:

 var i = document.createElement('p'); j.appendChild(i); 

Microsoft Internet Explorer 8 improperly handles script-modified DOM structures when an HTML document is being parsed. By manipulating DOM script code, a circular reference between two DOM objects can be created. This error can lead to memory corruption which could be exploited to inject and execute arbitrary code. Remote attackers could exploit this vulnerability by persuading a target user to visit a maliciously crafted web page. Successful exploitation may result in code execution with the privileges of the logged in user.

Generic detection of this type of attack would require a full HTML parser. As such, generic detection is not feasible. SonicWALL has developed a signature that detects and blocks a known exploit targeting this vulnerability. The following signature was released:

• 4234 – MS IE Uninitialized DOM Memory Corruption PoC (MS09-072)

The vendor has released an advisory and assigned the vulnerability the ID MS09-072. This flaw has been assigned CVE-2009-3674 by Mitre.

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.