CVE-2012-1876
Microsoft Internet Explorer 6-9 and 10 Consumer Preview - Remote Code Execution via Col Element Handling
Title source: llmExploitation Summary
EIP tracks 9 public exploits for CVE-2012-1876.
PoCs published by ryujin & sickness, sickness, Metasploit, including Metasploit module exploits/windows/browser/ms12_037_ie_colspan.
AI-analyzed exploit summary This exploit leverages a heap spray and ROP chain to bypass DEP, ASLR, and EMET 5.1 protections in Internet Explorer 8 via CVE-2012-1876. It includes shellcode execution and specific techniques to disable EMET protections.
Description
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
Exploits (9)
This exploit leverages a heap spray and ROP chain to bypass DEP, ASLR, and EMET 5.1 protections in Internet Explorer 8 via CVE-2012-1876. It includes shellcode execution and specific techniques to disable EMET protections.
This exploit leverages a heap spray technique combined with ROP chains to bypass DEP, ASLR, and EMET 5.0 in Internet Explorer 8. It targets CVE-2012-1876, a Fixed Col Span ID vulnerability, to achieve remote code execution.
This exploit leverages a use-after-free vulnerability in Internet Explorer 8 (CVE-2012-1876) to achieve remote code execution by bypassing ASLR, DEP, and EMET 4.1.X. It employs heap spraying and ROP chains to disable EMET protections and execute shellcode.
This exploit leverages a heap overflow vulnerability in Internet Explorer 8 (CVE-2012-1876) to bypass ASLR and DEP, achieving remote code execution via a crafted HTML page with heap spraying and ROP chains.
This Metasploit module exploits a heap overflow vulnerability in Internet Explorer 8 by manipulating the span attribute of col elements in a fixed table via JavaScript, leading to remote code execution.
The repository contains only a README.md file with minimal information about CVE-2012-1876, mentioning a 'simple calc exploitation' without any actual exploit code or technical details.
This Metasploit module exploits a heap overflow vulnerability in Internet Explorer (CVE-2012-1876) by manipulating the 'span' attribute of 'col' elements in a fixed table via JavaScript, leading to remote code execution. It includes ROP chains for different Windows versions and uses heap spraying to achieve reliable exploitation.