ID CVE-2013-2551
Summary Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
References
Vulnerable Configurations
  • Microsoft Internet Explorer 6
    cpe:2.3:a:microsoft:internet_explorer:6
  • Microsoft Internet Explorer 7
    cpe:2.3:a:microsoft:internet_explorer:7
  • Microsoft Internet Explorer 8
    cpe:2.3:a:microsoft:internet_explorer:8
  • Microsoft Internet Explorer 9
    cpe:2.3:a:microsoft:internet_explorer:9
  • Microsoft Internet Explorer 10
    cpe:2.3:a:microsoft:internet_explorer:10
CVSS
Base: 9.3 (as of 19-10-2016 - 10:42)
Impact:
Exploitability:
CWE CWE-416
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
exploit-db via4
description Microsoft Internet Explorer - COALineDashStyleArray Integer Overflow (MS13-009). CVE-2013-1298,CVE-2013-2551. Remote exploit for windows platform
id EDB-ID:26175
last seen 2016-02-03
modified 2013-06-13
published 2013-06-13
reporter metasploit
source https://www.exploit-db.com/download/26175/
title Microsoft Internet Explorer - COALineDashStyleArray Integer Overflow MS13-009
metasploit via4
description This module exploits an integer overflow vulnerability on Internet Explorer. The vulnerability exists in the handling of the dashstyle.array length for vml shapes on the vgx.dll module. The exploit has been built and tested specifically against Windows 7 SP1 with Internet Explorer 8. It uses either JRE6 or an information leak (to ntdll) to bypass ASLR, and by default the info leak is used. To make sure the leak is successful, the ntdll version should be either v6.1.7601.17514 (the default dll version on a newly installed/unpatched Windows 7 SP1), or ntdll.dll v6.1.7601.17725 (installed after apply MS12-001). If the target doesn't have the version the exploit wants, it will refuse to attack by sending a fake 404 message (webpage not found). If you wish to try the JRE6 component instead to bypass ASLR, you can set the advanced datastore option to 'JRE6'. If JRE6 is chosen but the target doesn't have this particular component, the exploit will also refuse to attack by sending a 404 message.
id MSF:EXPLOIT/WINDOWS/BROWSER/MS13_037_SVG_DASHSTYLE
last seen 2019-03-24
modified 2017-10-05
published 2013-06-12
reliability Normal
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb
title MS13-037 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow
msbulletin via4
bulletin_id MS13-037
bulletin_url
date 2013-05-14T00:00:00
impact Remote Code Execution
knowledgebase_id 2829530
knowledgebase_url
severity Critical
title Cumulative Security Update for Internet Explorer
nessus via4
NASL family Windows : Microsoft Bulletins
NASL id SMB_NT_MS13-037.NASL
description The remote host is missing Internet Explorer (IE) Security Update 2829530. The installed version of IE is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code on the remote host.
last seen 2019-02-21
modified 2018-11-15
plugin id 66412
published 2013-05-15
reporter Tenable
source https://www.tenable.com/plugins/index.php?view=single&id=66412
title MS13-037: Cumulative Security Update for Internet Explorer (2829530)
oval via4
accepted 2014-08-18T04:01:32.901-04:00
class vulnerability
contributors
  • name SecPod Team
    organization SecPod Technologies
  • name Maria Mikhno
    organization ALTX-SOFT
definition_extensions
  • comment Microsoft Internet Explorer 6 is installed
    oval oval:org.mitre.oval:def:563
  • comment Microsoft Windows XP (32-bit) is installed
    oval oval:org.mitre.oval:def:1353
  • comment Microsoft Windows XP x64 is installed
    oval oval:org.mitre.oval:def:15247
  • comment Microsoft Windows Server 2003 (32-bit) is installed
    oval oval:org.mitre.oval:def:1870
  • comment Microsoft Windows Server 2003 (x64) is installed
    oval oval:org.mitre.oval:def:730
  • comment Microsoft Windows Server 2003 (ia64) Gold is installed
    oval oval:org.mitre.oval:def:396
  • comment Microsoft Internet Explorer 7 is installed
    oval oval:org.mitre.oval:def:627
  • comment Microsoft Windows XP (32-bit) is installed
    oval oval:org.mitre.oval:def:1353
  • comment Microsoft Windows XP x64 is installed
    oval oval:org.mitre.oval:def:15247
  • comment Microsoft Windows Server 2003 (32-bit) is installed
    oval oval:org.mitre.oval:def:1870
  • comment Microsoft Windows Server 2003 (x64) is installed
    oval oval:org.mitre.oval:def:730
  • comment Microsoft Windows Server 2003 (ia64) Gold is installed
    oval oval:org.mitre.oval:def:396
  • comment Microsoft Windows Vista (32-bit) is installed
    oval oval:org.mitre.oval:def:1282
  • comment Microsoft Windows Vista x64 Edition is installed
    oval oval:org.mitre.oval:def:2041
  • comment Microsoft Windows Server 2008 (32-bit) is installed
    oval oval:org.mitre.oval:def:4870
  • comment Microsoft Windows Server 2008 (64-bit) is installed
    oval oval:org.mitre.oval:def:5356
  • comment Microsoft Windows Server 2008 (ia-64) is installed
    oval oval:org.mitre.oval:def:5667
  • comment Microsoft Internet Explorer 8 is installed
    oval oval:org.mitre.oval:def:6210
  • comment Microsoft Windows Server 2003 (32-bit) is installed
    oval oval:org.mitre.oval:def:1870
  • comment Microsoft Windows Server 2003 (x64) is installed
    oval oval:org.mitre.oval:def:730
  • comment Microsoft Windows XP (32-bit) is installed
    oval oval:org.mitre.oval:def:1353
  • comment Microsoft Windows XP x64 is installed
    oval oval:org.mitre.oval:def:15247
  • comment Microsoft Windows Server 2008 (32-bit) is installed
    oval oval:org.mitre.oval:def:4870
  • comment Microsoft Windows Server 2008 (64-bit) is installed
    oval oval:org.mitre.oval:def:5356
  • comment Microsoft Windows Vista (32-bit) is installed
    oval oval:org.mitre.oval:def:1282
  • comment Microsoft Windows Vista x64 Edition is installed
    oval oval:org.mitre.oval:def:2041
  • comment Microsoft Windows 7 (32-bit) is installed
    oval oval:org.mitre.oval:def:6165
  • comment Microsoft Windows 7 x64 Edition is installed
    oval oval:org.mitre.oval:def:5950
  • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
    oval oval:org.mitre.oval:def:6438
  • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
    oval oval:org.mitre.oval:def:5954
  • comment Microsoft Internet Explorer 9 is installed
    oval oval:org.mitre.oval:def:11985
  • comment Microsoft Windows Server 2008 (32-bit) is installed
    oval oval:org.mitre.oval:def:4870
  • comment Microsoft Windows Server 2008 (64-bit) is installed
    oval oval:org.mitre.oval:def:5356
  • comment Microsoft Windows 7 (32-bit) is installed
    oval oval:org.mitre.oval:def:6165
  • comment Microsoft Windows 7 x64 Edition is installed
    oval oval:org.mitre.oval:def:5950
  • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
    oval oval:org.mitre.oval:def:6438
  • comment Microsoft Windows Vista (32-bit) is installed
    oval oval:org.mitre.oval:def:1282
  • comment Microsoft Windows Vista x64 Edition is installed
    oval oval:org.mitre.oval:def:2041
  • comment Microsoft Internet Explorer 10 is installed
    oval oval:org.mitre.oval:def:15751
  • comment Microsoft Windows 7 (32-bit) is installed
    oval oval:org.mitre.oval:def:6165
  • comment Microsoft Windows 7 x64 Edition is installed
    oval oval:org.mitre.oval:def:5950
  • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
    oval oval:org.mitre.oval:def:6438
  • comment Microsoft Windows 8 (x86) is installed
    oval oval:org.mitre.oval:def:14914
  • comment Microsoft Windows 8 (x64) is installed
    oval oval:org.mitre.oval:def:15571
  • comment Microsoft Windows Server 2012 is installed
    oval oval:org.mitre.oval:def:16359
description Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
family windows
id oval:org.mitre.oval:def:16317
status accepted
submitted 2013-05-17T10:11:57
title Internet Explorer Use After Free Vulnerability - (CVE-2013-2551) MS13-037
version 71
packetstorm via4
data source https://packetstormsecurity.com/files/download/121997/ms13_037_svg_dashstyle.rb.txt
id PACKETSTORM:121997
last seen 2016-12-05
published 2013-06-13
reporter Nicolas Joly
source https://packetstormsecurity.com/files/121997/MS13-009-Microsoft-Internet-Explorer-COALineDashStyleArray-Integer-Overflow.html
title MS13-009 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow
refmap via4
cert TA13-134A
misc
ms MS13-037
saint via4
bid 58570
description Internet Explorer VML Dashstyle Attributes Integer Overflow
id win_patch_ie_v8,win_patch_ie_v9,win_patch_ie_v10
osvdb 91197
title ie_vml_dashstyle_int_overflow
type client
Last major update 19-10-2016 - 13:46
Published 11-03-2013 - 06:55
Last modified 12-10-2018 - 18:04
Back to Top