CVE-2008-4844
EXPLOITED IN THE WILDMicrosoft Internet Explorer 5.01, 6, 6 SP1, and 7 - Use-After-Free via DSO Bindings
Title source: llmExploitation Summary
CVE-2008-4844 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 6 public exploits from researchers including Metasploit, Jeremy Brown, krafty, including a Metasploit module exploits/windows/browser/ms08_078_xml_corruption.
AI-analyzed exploit summary This Metasploit module exploits a memory corruption vulnerability in Internet Explorer's data binding feature (CVE-2008-4844) using a .NET DLL memory technique to achieve remote code execution.
Description
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2) XML DSOs, or (3) Tabular Data Control (TDC) in a crafted HTML or XML document, as demonstrated by nested SPAN or MARQUEE elements, and exploited in the wild in December 2008.
Exploits (6)
This Metasploit module exploits a memory corruption vulnerability in Internet Explorer's data binding feature (CVE-2008-4844) using a .NET DLL memory technique to achieve remote code execution.
This Perl script generates an HTML file exploiting a buffer overflow in Microsoft Internet Explorer on Vista via malformed XML handling. It includes shellcode for a reverse shell connection.
This exploit leverages a heap corruption vulnerability in Internet Explorer (CVE-2008-4844) via malformed XML data. It uses a heap spray technique to achieve reliable code execution, demonstrated by launching the calculator (calc.exe).
This exploit targets a vulnerability in Internet Explorer 7 on Windows XP SP3, using a Metasploit-generated shellcode to execute arbitrary commands (e.g., launching calc.exe). The exploit is packaged in a compressed file, indicating a functional proof-of-concept.
This exploit leverages a heap spray technique to trigger a remote code execution vulnerability in Microsoft Internet Explorer 7 on Windows Vista. The exploit uses a malformed XML parsing mechanism to achieve arbitrary code execution via a crafted iframe and shellcode.
This Metasploit module exploits a memory corruption vulnerability in Internet Explorer's data binding feature (CVE-2008-4844) by leveraging a .NET DLL memory technique to achieve remote code execution. It uses a combination of heap spraying and vtable manipulation to execute arbitrary payloads on vulnerable systems.