CVE-2013-0074

What is Microsoft Silverlight?

Microsoft Silverlight was a browser plugin similar in purpose to Adobe Flash — it enabled rich interactive applications in web pages, including video streaming, animations, and data visualizations. Silverlight was particularly used by Netflix (until 2016) and some enterprise line-of-business applications. Like Flash, its browser plugin integration created attack surface exploitable through drive-by downloads. Microsoft ended support for Silverlight on October 12, 2021.

Overview

CVE-2013-0074 is a double pointer dereference vulnerability in Microsoft Silverlight's HTML object rendering engine. The flaw arises from improper validation of pointers when processing HTML objects within a Silverlight application — following a freed or invalid pointer a second time leads to memory corruption and allows arbitrary code execution.

Despite the "Local" CVSS attack vector, the vulnerability was exploited via drive-by download: a Silverlight application embedded in a web page triggers the vulnerability when rendered in the browser. The "Local" designation reflects that Silverlight plugin content renders in the local browser process context.

Microsoft patched this in Security Bulletin MS13-022 on March 12, 2013.

Affected Versions

Technical Details

A double dereference vulnerability occurs when a pointer to freed or invalid memory is dereferenced twice. In Silverlight's HTML rendering, an object pointer could become invalid during rendering operations; the code then dereferenced this invalid pointer a second time, causing memory corruption. Depending on heap state, this corruption could be leveraged into reliable code execution by an attacker who controls the Silverlight application content.

Attack delivery: A malicious website hosting a Silverlight application (.xap file) that triggers the vulnerability. When a user with the Silverlight plugin visits the page, the plugin loads and processes the malicious application, triggering the double dereference. No user interaction beyond visiting the page is required in practice, despite the "User Interaction: Required" CVSS designation (which counts visiting a page as user interaction).

Discovery

The vulnerability was discovered through security research and coordinated with Microsoft prior to the March 2013 Patch Tuesday release.

Exploitation Context

CVE-2013-0074 was incorporated into major crimeware exploit kits — most notably Angler Exploit Kit and Neutrino Exploit Kit — which used it to deliver ransomware payloads (hence ransomwareUse: true). At the time, Netflix and other streaming services used Silverlight, meaning the plugin had broad consumer and enterprise deployment. Silverlight exploit kit integration allowed attackers to reach users who had patched Java but still had Silverlight installed.

Remediation

Microsoft Silverlight reached end-of-life on October 12, 2021. Organizations should:

1. Verify Silverlight is completely removed from all endpoints
2. Check via Group Policy or endpoint management for any remaining Silverlight installations
3. Audit legacy intranet applications or streaming services that may have required Silverlight — migrate to HTML5 alternatives
4. Block .xap file downloads at web content filters