首先是漏洞的原因：
Background
The bug was an invalid pointer dereference in MSHTML.DLL when the code handles data binding. It's important to point out that there is no heap corruption and there is no heap-based buffer overrun!
When data binding is used, IE creates an object which contains an array of data binding objects. In the code in question, when a data binding object is released, the array length is not correctly updated leading to a function call into freed memory.
The vulnerable code looks a little like this (by the way, the real array name is _aryPXfer, but I figured ArrayOfObjectsFromIE is a little more descriptive for people not in the Internet Explorer team.)
int MaxIdx = ArrayOfObjectsFromIE.Size()-1;
for (int i=0; i <= MaxIdx; i++) {
if (!ArrayOfObjectsFromIE[i])
continue;
ArrayOfObjectsFromIE[i]->TransferFromSource();
...
}
Here's how the vulnerability manifests itself: if there are two data transfers with the same identifier (so MaxIdx is 2), and the first transfer updates the length of the ArrayOfObjectsFromIE array when its work was done and releases its data binding object, the loop count would still be whatever MaxIdx was at the start of the loop, 2.
This is a time-of-check-time-of-use (TOCTOU) bug that led to code calling into a freed memory block. The Common Weakness Enumeration (CWE) classification for this vulnerability is CWE-367.
The fix was to check the maximum iteration count on each loop iteration rather than once before the loop starts; this is the correct fix for a TOCTOU bug - move the check as close as possible to the action because, in this case, the array size might change.
Upon opening the word document the embedded ActiveX control with the following classid is instantiated and executed.
{AE24FDAE-03C6-11D1-8B76-0080C744F389}
This control stores configuration data for the policy setting Microsoft Scriptlet Component.
488×199
The control then makes a request to the webpage hosting the IE 7 exploit. The charm with this approach is that the exploit is downloaded and run without the knowledge or permission of the user. To the unsuspecting user it will just appear as yet another normal Doc file. 作者: 丘石 时间: 2014-7-15 15:36
这是什么东东啊作者: lesleylily 时间: 2014-7-15 15:36
不知该说些什么。。。。。。就是谢谢作者: langyawang 时间: 2014-7-15 15:39
帮帮顶顶！！作者: Doris 时间: 2014-7-15 15:40
支持一下:lol作者: 丘石 时间: 2014-7-15 15:40
看帖回帖是美德！:lol作者: 丘石 时间: 2014-7-15 15:46
路过，学习下作者: 哀家姓夏 时间: 2014-7-15 23:01
找到好贴不容易，我顶你了，谢了作者: 事业无忧 时间: 2014-7-16 04:20
了解了这些知识很有用，顶楼主！作者: 杏花朵朵 时间: 2014-7-16 10:45
好啊楼主，没想到啊，太好了