The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Microsoft Internet Explorer Multiple CSS Imports Memory Corruption
(MS06-042)
------------------------------------------------------------------------
SUMMARY
Microsoft Internet Explorer's CSS bad handling can be used to corrupt the
memory used by Internet Explorer which in turn can be used to cause the
product to execute arbitrary code.
DETAILS
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of Microsoft Internet Explorer. User interaction
is required to exploit this vulnerability in that the target must visit a
malicious page.
The specific flaw exists due to improper garbage collection when multiple
"imports" are used on a "styleSheets" collection. Crafting a long chain of
CSS imports in an HTML document results in a memory corruption eventually
leading to code execution.
Vendor Response:
Microsoft has issued an update to correct this vulnerability. More details
can be found at:
<http://www.microsoft.com/technet/security/bulletin/MS06-042.mspx>
http://www.microsoft.com/technet/security/bulletin/MS06-042.mspx
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3451>
CVE-2006-3451
Disclosure Timeline:
2006.06.14 - Vulnerability reported to vendor
2006.08.08 - Digital Vaccine released to TippingPoint customers
2006.08.08 - Coordinated public release of advisory
ADDITIONAL INFORMATION
The information has been provided by Sam Thomas.
The original article can be found at:
<http://www.zerodayinitiative.com/advisories/ZDI-06-026.html>
http://www.zerodayinitiative.com/advisories/ZDI-06-026.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
