Vulnerability Details : CVE-2013-3918

Exploit prediction scoring system (EPSS) score for CVE-2013-3918

Metasploit modules for CVE-2013-3918

• MS13-090 CardSpaceClaimCollection ActiveX Integer Underflow

  Disclosure Date : 2013-11-08

  exploit/windows/browser/ms13_090_cardspacesigninhelper

  This module exploits a vulnerability on the CardSpaceClaimCollection class from the icardie.dll ActiveX control. The vulnerability exists while the handling of the CardSpaceClaimCollection object. CardSpaceClaimCollections stores a collection of elements on a SafeArray and keeps a size field, counting the number of elements on the collection. By calling the remove() method on an empty CardSpaceClaimCollection it is possible to underflow the length field, storing a negative integer. Later, a call to the add() method will use the corrupted length field to compute the address where write into the SafeArray data, allowing to corrupt memory with a pointer to controlled contents. This module achieves code execution by using VBScript as discovered in the wild on November 2013 to (1) create an array of html OBJECT elements, (2) create holes, (3) create a CardSpaceClaimCollection whose SafeArray data will r

  More information

CVSS scores for CVE-2013-3918

CWE ids for CVE-2013-3918

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
  Assigned by: [email protected] (Primary)

References for CVE-2013-3918

Products affected by CVE-2013-3918