-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
National Cyber Alert System
Cyber Security Alert SA06-262A
Microsoft Internet Explorer VML Vulnerability
Original release date: September 19, 2006
Last revised: --
Source: US-CERT
Systems Affected
* Microsoft Windows
* Microsoft Internet Explorer
Overview
A vulnerability in Microsoft Internet Explorer could allow an
attacker to take control of your computer.
Solution
Microsoft has not yet released an update to address this
vulnerability. From Microsoft Security Advisory (925568):
A security update to address this vulnerability is now being
finalized through testing to ensure quality and application
compatibility. Microsoft's goal is to release the update on
Tuesday, October 10, 2006, or sooner depending on customer
needs.
Until an update is available, consider the following workarounds.
Disable Binary and Script Behaviors
Follow the steps in Microsoft Security Advisory (925568) under
the section titled "Configure Internet Explorer 6 for Microsoft
Windows XP Service Pack 2 to disable Binary and Script
Behaviors in the Internet and Local Intranet security zone."
Do not follow unsolicited links
Do not click on unsolicited URLs, including those received in
email, instant messages, web forums, or internet relay chat
(IRC) channels.
Description
An attacker could exploit a vulnerability in Internet Explorer
Vector Markup Language (VML) by convincing a user to open an HTML
document such as a web site or an HTML email message. The
attacker could then take any action as the user, including
installing malicious software and accessing sensitive personal
information.
For more technical information, see Vulnerability Note VU#416092.
References
* Vulnerability Note VU#416092 -
<http://www.kb.cert.org/vuls/id/416092>
* Securing Your Web Browser -
<http://www.us-cert.gov/reading_room/securing_browser/>
* Microsoft Security Advisory (925568) -
<http://www.microsoft.com/technet/security/advisory/925568.mspx>
* 4 steps to help ward off hackers and attackers -
<http://www.microsoft.com/athome/security/online/browsing_safety.m
spx>
* Microsoft Security Essentials -
<http://www.microsoft.com/protect/>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/alerts/SA06-262A.html>
____________________________________________________________________
Feedback can be directed to US-CERT. Please send email to
<cert@cert.org> with "SA06-262A Feedback VU#416092" in the subject.
____________________________________________________________________
Mailing list information:
<http://www.us-cert.gov/cas/>
____________________________________________________________________
Produced 2006 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
September 19, 2006: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iQEVAwUBRRBrjexOF3G+ig+rAQIt3QgAwK6BwcfGihzpvBLiRkA8HrxeFrXMIFAr
JP4aqUS7Lpp1iUSD4Prf/9ibqO8CB9816zztWJ632kMlRX5LB95BkPpzdicC9TbN
J4vz06pgtXiusz8dnbSJsPa8zFzJErfv6A3O5GUbZAcnFqUiONy0g77LuVkbYBTM
ukJfZreUSLPHUIvMS9W0C6Ic0mz/SxfSBQN0NGxLxJe3WmvmRaNtCOINNmT+9RZG
BKQTr4PwX4yKKp1UfqReDsadAYN4Wr9XqNJN1njGfqhoR2N26nUenzgIBU2AnZ1A
E+3V2LlCxoZfmuj4/GVgn+D31R8LIMBCcH8zzQSEK7Jrq+oBALP0zQ==
=RbYH
-----END PGP SIGNATURE-----
