Microsoft Internet Explorer DHTML Engine Race Condition Vulnerability
iDEFENSE Security Advisory 04.12.05
www.idefense.com/application/poi/display?id=228&type=vulnerabilities
April 12, 2005
I. BACKGROUND
Internet Explorer is a set of core technologies in Microsoft Windows
operating systems that provide web browsing functionality. Further
information is available at:
http://www.microsoft.com/ie/.
Dynamic HTML (DHTML) is built on an object model that extends the
traditional static HTML document to enable web authors to create more
engaging and interactive Web pages. DHTML provides authors with enhanced
creative control so they can manipulate any page element at any time.
More information is available at:
http://www.microsoft.com/windows/ie
http://msdn.microsoft.com/workshop/author/dhtml/dhtml_node_entry.asp
II. DESCRIPTION
Remote exploitation of a race condition vulnerability in version 6 of
Microsoft Corporation's Internet Explorer web browser could allow the
execution of arbitrary code under the privileges of the currently logged
in user.
Internet Explorer supports dynamic creation of HTML elements with
JavaScript using various DHTML methods such as createElement(),
appendChild(), and removeNode(). A number of problems have been found in
the implementation of these objects and methods, including some which
can be exploited to cause execution of arbitrary code.
The problem specifically exists within the memory management routines of
Internet Explorer's object handling code. In some situations one thread
reads data from memory that has either been overwritten by another
thread or has not yet been initialized by another thread. This can lead
to random crashes and remote command execution.
III. ANALYSIS
Successful exploitation allows remote attackers to execute arbitrary
code in the context of the user running the Internet Explorer process.
Exploitation will not be 100% reliable. However, proof of concept
exploit code was generated with reliable execution approximately 90% of
the time.
In order to exploit this vulnerability an attacker must convince the
victim to visit a web site, or cause malicious DHTML code to be rendered
by Internet Explorer using some other technique, such as a persist ant
XSS (cross-site scripting) attack on a trusted site.
IV. DETECTION
iDEFENSE has confirmed the existence of this vulnerability in the
following Microsoft Internet Explorer versions:
6.0.2900.2180 on Windows XP Professional with Service Pack 2.
6.0.2800.1106 on Windows XP Professional with Service Pack 1.
6.0.2800.1106 on Windows 2000 Professional with Service Pack 4.
It is suspected that all versions of Internet Explorer 6.0 are affected.
V. WORKAROUND
Disable active scripting, if it is not necessary for daily operations,
using the following steps:
1. In IE, click on Tools and select Internet Options from the drop-down
menu.
2. Click the Security tab and the Custom Level button.
3. Under Scripting, then Active Scripting, click the Disable radio
button.
VI. VENDOR RESPONSE
This vulnerability is addressed in Microsoft Security Bulletin MS05-020
available at:
http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0553 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
10/25/2004 Initial vendor notification
10/25/2004 Initial vendor response
04/12/2005 Coordinated public disclosure
IX. CREDIT
Berend-Jan Wever (skylined[at]edup.tudelft.nl,
http://www.edup.tudelft.nl/~bjwever/) is credited with this discovery.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright (c) 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
