[NT] Microsoft Internet Explorer Property Memory Corruption Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Microsoft Internet Explorer Property Memory Corruption Vulnerability
------------------------------------------------------------------------


SUMMARY

<http://www.microsoft.com/ie/> Internet Explorer is "a graphical web
browser developed by Microsoft Corp. that has been included with Microsoft
Windows since 1995". Remote exploitation of a memory corruption
vulnerability in Microsoft Corp.'s Internet Explorer web browser allows
attackers to execute arbitrary code within the context of the affected
user.

DETAILS

Vulnerable Systems:
* Internet Explorer version 6.0
* Internet Explorer version 7.0

When certain properties are assigned malformed values, memory can be
corrupted in a way that leads to Internet Explorer making a call to a
member function of an already released property object. If the memory
location of the released property object happens to be filled by attacker
controlled content, the attacker can execute arbitrary code.

Analysis:
Exploitation of this vulnerability would allow an attacker to execute
arbitrary code in the context of the user running Internet Explorer. In
order to be successful, a targeted user must render a maliciously crafted
web page.

On Vista, Internet Explorer 7 runs in Protected Mode, which has less
privileges than a normal user. It somewhat mitigates the impact of this
vulnerability, but does not prevent arbitrary code execution.

Workaround:
Disabling active scripting for the Internet Zone can effectively mitigate
this issue.

Vendor response:
Microsoft has officially addressed this vulnerability with Security
Bulletin MS08-010. For more information, consult their bulletin at the
following URL.
<http://www.microsoft.com/technet/security/Bulletin/ms08-010.mspx>
http://www.microsoft.com/technet/security/Bulletin/ms08-010.mspx

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0077>
CVE-2008-0077

Disclosure Timeline:
10/24/2007 - Initial vendor notification
10/24/2007 - Initial vendor response
02/12/2008 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@xxxxxxxxxxxx> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=661>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=661



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Microsoft Windows 2000 Agent URL Canonicalizing Stack Based Buffer Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Windows 2000 Agent URL Canonicalizing Stack Based Buffer ... Remote exploitation of a stack based buffer overflow vulnerability in ...
    (Securiteam)
  • [NT] Microsoft Office Works Converter Heap Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Office Works Converter Heap Overflow Vulnerability ... Microsoft Works is "a word processor created by Microsoft in the 1980s. ... Exploitation might require the installation of additional Microsoft Office ...
    (Securiteam)
  • [NT] Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor Multiple Product URI Handler Input Validation ... exploitation of an input handling vulnerability within multiple browsers ... on the Microsoft Windows platform allows code execution as the local user. ...
    (Securiteam)
  • [NT] Comodo DLL Injection via Weak Hash Function Exploitation Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Comodo DLL Injection via Weak Hash Function Exploitation Vulnerability ... register unsigned long crc; ... This program assumes that Internet Explorer is a privileged application ...
    (Securiteam)
  • [NT] Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerabi
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is "a set of core technologies in Microsoft Windows ... exploitation of an invalid memory access vulnerability in various ... COM objects may allow an attacker to execute arbitrary code. ...
    (Securiteam)