CVE-2013-3896
published 2013-10-09CVE-2013-3896: Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain…
PriorityP180medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-06-15
Exploited in the wild
EPSS
69.61%
99.3th percentile
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | silverlight | >= 5.0 < 5.1.20913.0 | 5.1.20913.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2013-3896 is exploited via the public WriteableBitmap class in System.Windows.dll to leak the base address of mscorlib.ni.dll, enabling ASLR/DEP bypass. Detect Silverlight applications invoking WriteableBitmap in conjunction with memory address calculations. ↗
- →CVE-2013-3896 is chained with CVE-2013-0074 in exploit kits: the info-leak provides the mscorlib.ni.dll base address which is then passed to the RCE trigger. Detect .xap files served with Content-Type application/x-silverlight-2 that contain both WriteableBitmap and ScriptObject usage. ↗
- →The Metasploit module targets Internet Explorer (IE6–IE10) on Windows x86/x64 with Silverlight enabled. Browser requirement checks for ua_name IE and silverlight=true can be used as a detection pivot in proxy/web logs. ↗
- →The exploit serves a randomly named .xap file with Content-Type application/x-silverlight-2 and a matching randomly named .dll. Detect HTTP responses serving application/x-silverlight-2 with randomized filenames (5–10 alpha chars) followed by .xap. ↗
- →The exploit module uses post/windows/manage/priv_migrate as the InitialAutoRunScript after successful exploitation. Detect post-exploitation privilege migration activity following Silverlight process crashes or abnormal iexplore.exe child process spawning. ↗
- ·CVE-2013-3896 is an information-disclosure (memory leak) vulnerability used solely to bypass ASLR/DEP; it does not achieve code execution on its own and is always paired with CVE-2013-0074 for a full exploit chain. ↗
- ·The vulnerability affects Microsoft Silverlight 5 versions prior to 5.1.20913.0 only. Systems running 5.1.20913.0 or later are not affected. ↗
- ·The Metasploit module's exploit payload is NOP-padded to 4-byte alignment and base64-encoded before delivery, which may affect signature-based detection of the raw shellcode in transit. ↗
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vulncheck5.5MEDIUM
cisa5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Silverlight Information Disclosure Vulnerability
cisa·2022-05-25·CVSS 5.5
CVE-2013-3896 [MEDIUM] CWE-20 Microsoft Silverlight Information Disclosure Vulnerability
Vulnerability: Microsoft Silverlight Information Disclosure Vulnerability
Affected: Microsoft Silverlight
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2013-3896
Remediation Due Date: 2022-06-15
GHSA
GHSA-8wm7-83p7-m6fh: Microsoft Silverlight 5 before 5
ghsa_unreviewed·2022-05-14
CVE-2013-3896 [MEDIUM] CWE-20 GHSA-8wm7-83p7-m6fh: Microsoft Silverlight 5 before 5
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
VulnCheck
Microsoft Silverlight Information Disclosure Vulnerability
vulncheck·2013·CVSS 5.5
CVE-2013-3896 [MEDIUM] CWE-20 Microsoft Silverlight Information Disclosure Vulnerability
Microsoft Silverlight Information Disclosure Vulnerability
Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.
Affected: Microsoft Silverlight
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Known Ransomware Campaign Use: Known
Exploitation References: https://cybersecurityworks.com/pdf/ransomware/Spotlight_Ransomware2021.pdf; https://dl.acm.org/doi/pdf/10.1145/3465481.3465758; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-06-15
No detection rules found.
Exploit-DB
Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)
exploitdb·2013-03-12
CVE-2013-0074 Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)
Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule
EOS
def initialize(info={})
super(update_info(info,
'Name' => "MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access",
'Description' => %q{
This module exploits a vulnerability in Microsoft Silverlight. The vulnerability exists on
the Initialize() method from System.Windows.Browser.ScriptObject, which access memory in an
unsafe manner. Since it is accessible for untrusted code (user controlled) it's possible
to dereference arbitrary memory which easily leverages to arbitrary code execution. In order
t
Metasploit
MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access
metasploit
MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access
MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access
This module exploits a vulnerability in Microsoft Silverlight. The vulnerability exists on the Initialize() method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code (user controlled) it's possible to dereference arbitrary memory which easily leverages to arbitrary code execution. In order to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class from System.Windows.dll. This module has been tested successfully on IE6 - IE10, Windows XP SP3 / Windows 7 SP1.
Zscaler
Exploit Kits: Anatomy Of A Silverlight Exploit | Zscaler
blogs_zscaler·2015-01-30·CVSS 7.8
[HIGH] Exploit Kits: Anatomy Of A Silverlight Exploit | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Microsoft Update Tuesday October 2013: Another IE 0-day release
blogs_talos·2013-10-08·CVSS 9.3
CVE-2013-3893 [CRITICAL] Microsoft Update Tuesday October 2013: Another IE 0-day release
This month's Microsoft Tuesday Update brings us 8 bulletins for a total of 26 CVEs. Four of these bulletins are marked as critical, while the rest are marked as important.
First, let's take a look at the 4 critical bulletins:
The most important update this month is a cumulative update for IE (MS13-080), which fixes 10 CVE issues, 2 of which have already been exploited by attackers. The first 0-day that's being fixed was widely reported and exploited (CVE-2013-3893). The second one (CVE-2013-3897) was also exploited on the web, but in a more targeted manner. We have a blog post concerning this vulnerability here. Most of the issues fixed in this bulletin are the result of use-after-free vulnerabilities.
The second bulletin (MS13-081) covers Windows Kernel Mode Drivers. One particularly i
Talos
Microsoft Update Tuesday October 2013: Another IE 0-day release
blogs_talos·2013-10-08·CVSS 9.3
[CRITICAL] Microsoft Update Tuesday October 2013: Another IE 0-day release
## Microsoft Update Tuesday October 2013: Another IE 0-day release
This month's Microsoft Tuesday Update brings us 8 bulletins for a total of 26 CVEs. Four of these bulletins are marked as critical, while the rest are marked as important.
First, let's take a look at the 4 critical bulletins:
The most important update this month is a cumulative update for IE ( MS13-080 ), which fixes 10 CVE issues, 2 of which have already been exploited by attackers. The first 0-day that's being fixed was widely reported and exploited ( CVE-2013-3893 ). The second one ( CVE-2013-3897 ) was also exploited on the web, but in a more targeted manner. We have a blog post concerning this vulnerability here . Most of the issues fixed in this bulletin are the result of use-after-free vulnerabilities.
The second
Recorded Future
Tracking Moving Targets: Exploit Kits and CVEs
blogs_recorded_future
Tracking Moving Targets: Exploit Kits and CVEs
# Tracking Moving Targets: Exploit Kits and CVEs
One year ago a notorious programmer Paunch, who coded the Blackhole exploit kit, was arrested and charged for the distribution and sale of his wares. Blackhole was an epic Russian exploit kit, rented and used by thousands for their successful campaigns against a range of targets.
Since Paunch’s arrest, the exploit kit threat landscape has changed significantly as malicious actors have sought out new tool kits. Recorded Future undertook the task of analyzing over 600,000 unique web sources to identify the most prevalent exploit kits, what CVEs they commonly leverage, and what the most vulnerable products are.
To get started, let’s craft a simple query looking for mentions of any exploit kit over the last six months.
###### Click image for
Recorded Future
Tracking Moving Targets: Exploit Kits and CVEs
blogs_recorded_future
Tracking Moving Targets: Exploit Kits and CVEs
## Tracking Moving Targets: Exploit Kits and CVEs
One year ago a notorious programmer Paunch, who coded the Blackhole exploit kit , was arrested and charged for the distribution and sale of his wares. Blackhole was an epic Russian exploit kit, rented and used by thousands for their successful campaigns against a range of targets.
Since Paunch’s arrest , the exploit kit threat landscape has changed significantly as malicious actors have sought out new tool kits. Recorded Future undertook the task of analyzing over 600,000 unique web sources to identify the most prevalent exploit kits, what CVEs they commonly leverage, and what the most vulnerable products are.
To get started, let’s craft a simple query looking for mentions of any exploit kit over the last six months.
## Click image for
http://www.us-cert.gov/ncas/alerts/TA13-288Ahttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19055http://www.us-cert.gov/ncas/alerts/TA13-288Ahttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19055https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3896
2013-10-09
Published
2022-05-25
Added to CISA KEV
Exploited in the wild