Touching up Kernelsmith's wording.

It is merely the ROP chain, not the vuln, that requires Java.
unstable
Tod Beardsley 2012-09-20 14:52:52 -05:00
parent 883dc26d73
commit a5ffe7297f
1 changed files with 8 additions and 6 deletions

View File

@ -27,13 +27,15 @@ class Metasploit3 < Msf::Exploit::Remote
This module exploits a vulnerability found in Microsoft Internet Explorer (MSIE). When This module exploits a vulnerability found in Microsoft Internet Explorer (MSIE). When
rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner, rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner,
but the same memory is reused again later in the CMshtmlEd::Exec() function, leading but the same memory is reused again later in the CMshtmlEd::Exec() function, leading
to a use-after-free condition. Please note that this vulnerability has to a use-after-free condition.
been exploited in the wild since Sep 14 2012, and there is currently no official
patch for it.
This module requires the following dependencies on the target for the ROP chain to function. Please note that this vulnerability has been exploited in the wild since Sep 14 2012,
For WinXP SP3 with IE8, msvcrt must be present (which it is on default installs). For and there is currently no official patch for it.
Vista/Win7 with IE8 or Win7 with IE9, jre 1.6.x or below must be installed.
Also note that presently, this module has some target dependencies for the ROP chain to be
valid. For WinXP SP3 with IE8, msvcrt must be present (as it is by default).
For Vista or Win7 with IE8, or Win7 with IE9, JRE 1.6.x or below must be installed (which
is often the case).
}, },
'License' => MSF_LICENSE, 'License' => MSF_LICENSE,
'Author' => 'Author' =>