CVE-2010-3886
Internet Explorer - Exposure of Sensitive Information via Timer ID Heap Address Leak
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-3886. PoCs published by Ruben Santamarta.
AI-analyzed exploit summary This exploit demonstrates a pointer leak vulnerability in mshtml.dll via the CTimeoutEventList::InsertIntoTimeoutList function. It uses JavaScript to manipulate timer IDs and leak memory addresses, which could aid in further exploitation.
Description
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
Exploits (1)
This exploit demonstrates a pointer leak vulnerability in mshtml.dll via the CTimeoutEventList::InsertIntoTimeoutList function. It uses JavaScript to manipulate timer IDs and leak memory addresses, which could aid in further exploitation.