MS11-050 IE mshtml!CObjectElement Use After Free

This module exploits a use-after-free vulnerability in Internet Explorer. The vulnerability occurs when an invalid <object> tag exists and other elements overlap/cover where the object tag should be when rendered (due to their styles/positioning). The mshtml!CObjectElement is then freed from memory because it is invalid. However, the mshtml!CDisplay object for the page continues to keep a reference to the freed <object> and attempts to call a function on it, leading to the use-after-free. Please note that for IE 8 targets, JRE (Java Runtime Environment) is required to bypass DEP (Data Execution Prevention).

Search Other Modules

Exploit Rank

• Normal

Exploit Authors

• d0c_s4vage < >
• sinn3r < sinn3r [at] metasploit.com >
• bannedit < bannedit [at] metasploit.com >

Vulnerability References

• CVE-2011-1260
• OSVDB-72950
• MSB-MS11-050
• http://d0cs4vage.blogspot.com/2011/06/insecticides-dont-kill-bugs-patch.html

Exploit Targets

• 0 - Automatic (default)
• 1 - Internet Explorer 7 on XP SP3
• 2 - Internet Explorer 7 on Windows Vista
• 3 - Internet Explorer 8 on XP SP3
• 4 - Internet Explorer 8 on Windows 7
• 5 - Debug Target (Crash)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/browser/adobe_cooltype_sing
• exploit/windows/browser/adobe_flash_mp4_cprt
• exploit/windows/browser/adobe_flash_sps
• exploit/windows/browser/adobe_flashplayer_avm
• exploit/windows/browser/adobe_flashplayer_flash10o
• exploit/windows/browser/adobe_flashplayer_newfunction
• exploit/windows/browser/adobe_flatedecode_predictor02
• exploit/windows/browser/adobe_geticon
• exploit/windows/browser/adobe_jbig2decode
• exploit/windows/browser/adobe_media_newplayer

Exploit Usage Information

Exploit Module Options