Microsoft Windows Internet Explorer Long Hostname Heap Corruption
Vulnerability
iDEFENSE Security Advisory 04.12.05
www.idefense.com/application/poi/display?id=229&type=vulnerabilities
April 12, 2005
I. BACKGROUND
Internet Explorer is a set of core technologies in Microsoft Windows
operating systems that provide web browsing functionality. Further
information is available at:
http://www.microsoft.com/ie/.
II. DESCRIPTION
Remote exploitation of an input validation error in Microsoft Corp.'s
Internet Explorer may allow the execution of arbitrary code.
The vulnerability specifically exists in the handling of long hostnames.
When IE is requested to open a URL with a hostname part longer than
about 256 characters, the heap becomes slightly corrupted. This
corruption may cause no visible effect, or it may cause the Address Bar
to contain a URL with "garbage" characters as the hostname. It may also
cause IE to crash, referencing an invalid memory address. In testing
done, the addresses referred during a crash are at times controllable by
the web page containing the malformed URL.
III. ANALYSIS
Successful exploitation allows remote attackers to execute arbitrary
code under the privileges of the current user.
Although it is not trivial to exploit this vulnerability, it is believed
to be possible. Testing during verification of this vulnerability
revealed multiple situations where remotely supplied values were used to
reference memory locations. A remote attacker may be able to read data
from, write data to, or execute arbitrary code by supplying
specifically malformed content.
IV. DETECTION
iDEFENSE Labs has confirmed that Internet Explorer 6.0.2180 on Windows
XP with Service Pack 2 is vulnerable.
V. WORKAROUND
iDEFENSE is currently unaware of any effective workarounds for this
issue. The vulnerable functionality is a major part of the affected
product, and is it is not possible to disable it.
Although it will not prevent all means of exploitation, disable active
scripting if it is not necessary for day-to-day operations using the
following steps:
1. In IE, click on Tools and select Internet Options from the
drop-down menu.
2. Click the Security tab and the Custom Level button.
3. Under Scripting, then Active Scripting, click the Disable radio
button.
VI. VENDOR RESPONSE
This vulnerability is addressed in Microsoft Security Bulletin MS05-020
available at:
http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0554 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
11/11/2004 Initial vendor notification
11/11/2004 Initial vendor response
04/12/2005 Coordinated public disclosure
IX. CREDIT
3APA3A (http://www.security.nnov.ru/) and axle@bytefall are credited
with this discovery.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
