The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple Vulnerabilities in Internet Explorer (Heap Corruption, Race
Condition)
------------------------------------------------------------------------
SUMMARY
The heap corruption and race condition in Internet Explorer allow
attackers to execute arbitrary code in the Windows operating system.
DETAILS
Vulnerable Systems:
* Windows XP with Internet Explorer 6.0.2180
* Windows XP Professional with Service Pack 2
* Windows XP Professional with Service Pack 1
* Windows 2000 Professional with Service Pack 4
Heap Corruption:
The vulnerability specifically exists in the handling of long host-names.
When IE is requested to open a URL with a host-name part longer than about
256 characters, the heap becomes slightly corrupted. This corruption may
cause no visible effect, or it may cause the Address Bar to contain a URL
with "garbage" characters as the host-name. It may also cause IE to crash,
referencing an invalid memory address. In testing done, the addresses
referred during a crash are at times controllable by the web page
containing the malformed URL.
Remote exploitation of an input validation error in Microsoft Internet
Explorer allow the execution of arbitrary code.
Although it is not trivial to exploit this vulnerability, it is believed
to be possible. Testing during verification of this vulnerability revealed
multiple situations where remotely supplied values were used to reference
memory locations. A remote attacker may be able to read data from, write
data to, or execute arbitrary code by supplying specifically malformed
content.
Successful exploitation allows remote attackers to execute arbitrary code
under the privileges of the current user.
Workaround:
Although it will not prevent all means of exploitation, disable active
scripting if it is not necessary for day-to-day operations using the
following steps:
1. In IE, click on Tools and select Internet Options from the drop-down
menu.
2. Click the Security tab and the Custom Level button.
3. Under Scripting, then Active Scripting, click the Disable radio
button.
Race Condition:
Internet Explorer supports dynamic creation of HTML elements with
JavaScript using various DHTML methods such as createElement(),
appendChild(), and removeNode(). A number of problems have been found in
the implementation of these objects and methods, including some which can
be exploited to cause execution of arbitrary code.
The problem specifically exists within the memory management routines of
Internet Explorer's object handling code. In some situations one thread
reads data from memory that has either been overwritten by another thread
or has not yet been initialized by another thread. This can lead to random
crashes and remote command execution.
Remote exploitation of a race condition vulnerability in version 6 of
Microsoft Internet Explorer web browser could allow the execution of
arbitrary code under the privileges of the currently logged in user.
In order to exploit this vulnerability an attacker must convince the
victim to visit a web site, or cause malicious DHTML code to be rendered
by Internet Explorer using some other technique, such as a persist
cross-site scripting attack on a trusted site.
Successful exploitation allows remote attackers to execute arbitrary code
in the context of the user running the Internet Explorer process.
Exploitation will not be 100% reliable. However, proof of concept exploit
code was generated with reliable execution approximately 90% of the time.
Workaround:
Disable active scripting, if it is not necessary for daily operations,
using the following steps:
1. In IE, click on Tools and select Internet Options from the drop-down
menu.
2. Click the Security tab and the Custom Level button.
3. Under Scripting, then Active Scripting, click the Disable radio
button.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0553>
CAN-2005-0553
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0554>
CAN-2005-0554
Vendor Status:
The vendor has released updates for the following systems:
* Internet Explorer 5.01 Service Pack 3 on Microsoft Windows 2000 Service
Pack 3:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=6CF45449-03D8-40B8-A4C0-09F413EE8EAB>
http://www.microsoft.com/downloads/details.aspx?FamilyId=6CF45449-03D8-40B8-A4C0-09F413EE8EAB
* Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service
Pack 4:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=627F8991-7717-4ADE-A5AE-169591B6AAE0>
http://www.microsoft.com/downloads/details.aspx?FamilyId=627F8991-7717-4ADE-A5AE-169591B6AAE0
* Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service
Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows
XP Service Pack 1:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=92E5A83D-9131-4B20-915A-A444C51656DC>
http://www.microsoft.com/downloads/details.aspx?FamilyId=92E5A83D-9131-4B20-915A-A444C51656DC
* Internet Explorer 6 Service Pack 1 for Microsoft Windows XP 64-Bit
Edition Service Pack 1 (Itanium):
<http://www.microsoft.com/downloads/details.aspx?FamilyId=87241BC0-E1E9-4EFC-A6EC-5413119D3100>
http://www.microsoft.com/downloads/details.aspx?FamilyId=87241BC0-E1E9-4EFC-A6EC-5413119D3100
* Internet Explorer 6 for Microsoft Windows Server 2003:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=88879B7A-3F4D-40D4-ADFD-4BBD8D4D865F>
http://www.microsoft.com/downloads/details.aspx?FamilyId=88879B7A-3F4D-40D4-ADFD-4BBD8D4D865F
* Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based
Systems and Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium):
<http://www.microsoft.com/downloads/details.aspx?FamilyId=FF80E80F-862A-4484-BC9D-FE05F966F1F4>
http://www.microsoft.com/downloads/details.aspx?FamilyId=FF80E80F-862A-4484-BC9D-FE05F966F1F4
* Internet Explorer 6 for Microsoft Windows XP Service Pack 2:
<http://www.microsoft.com/downloads/details.aspx?FamilyId=974F9611-6352-4F9C-B258-346C317857C5>
http://www.microsoft.com/downloads/details.aspx?FamilyId=974F9611-6352-4F9C-B258-346C317857C5
Disclosure Timeline:
10/25/2004 - Initial vendor notification and Initial vendor response for
the Race Condition advisory
11/11/2004 - Initial vendor notification and Initial vendor response for
the Heap Corruption advisory
04/12/2005 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> idlabs.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=228&type=vulnerabilities>
http://www.idefense.com/application/poi/display?id=228&type=vulnerabilities and
at
<http://www.idefense.com/application/poi/display?id=229&type=vulnerabilities>
http://www.idefense.com/application/poi/display?id=229&type=vulnerabilities
The SecuriTeam advisory can be found at:
<http://www.securiteam.com/windowsntfocus/5AP0B0UFFM.html>
http://www.securiteam.com/windowsntfocus/5AP0B0UFFM.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
