Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-1771.
AI-analyzed exploit summary This is a functional proof-of-concept for CVE-2014-1771, demonstrating a use-after-free vulnerability in Internet Explorer's MSHTML!CInput::DoClick function. The exploit triggers memory corruption by freeing a CFormElement object and then writing to its freed memory.
Description
SChannel in Microsoft Internet Explorer 6 through 11 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack," aka "TLS Server Certificate Renegotiation Vulnerability."
Exploits (1)
This is a functional proof-of-concept for CVE-2014-1771, demonstrating a use-after-free vulnerability in Internet Explorer's MSHTML!CInput::DoClick function. The exploit triggers memory corruption by freeing a CFormElement object and then writing to its freed memory.