|
Internet Explorer Exception Handling Memory Corruption Vulnerability
|
|
|
|
|
Secunia Advisory:
|
SA19762
|
|
|
Release Date:
|
2006-04-25
|
|
Last Update:
|
2006-06-15
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Microsoft Internet Explorer 5.01
Microsoft Internet Explorer 6.x
|
| | CVE reference: | CVE-2006-1992 (Secunia mirror)
CVE-2006-2218 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Secunia Research has discovered a vulnerability in Internet Explorer, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a memory corruption error within the handling of certain exceptional conditions. This can e.g. be exploited by registering an exception handler for an object and then trigger a certain condition via e.g. a certain sequence of nested "object" HTML tags.
Successful exploitation allows execution of arbitrary code when a user e.g. visits a malicious web site.
NOTE: This vulnerability is a variant of a browser crash bug initially reported by Michal Zalewski.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Solution:
Apply patches.
Internet Explorer 5.01 SP4 on Windows 2000 SP4:
http://www.microsoft.com/downloads/de...=91A997DE-BAE4-4AC7-912D-79EF8ABAEF4F
Internet Explorer 6 SP1 on Windows 2000 SP4 or Windows XP SP1:
http://www.microsoft.com/downloads/de...=0EB17A41-FB43-413B-A5CC-41E1F3DEDE4F
Internet Explorer 6 for Windows XP SP2:
http://www.microsoft.com/downloads/de...=85CABE87-C4A0-4F80-BD1C-210E23FD8D81
Internet Explorer 6 for Windows Server 2003 and Windows Server 2003 SP1:
http://www.microsoft.com/downloads/de...=CCE7C875-C9A4-4C3D-A37B-946EE5E781E7
Internet Explorer 6 for Windows Server 2003 for Itanium-based systems (with or without SP1):
http://www.microsoft.com/downloads/de...=C8E4CFB6-1350-4AAE-B681-EE2ECAB41118
Internet Explorer 6 for Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/de...=1C7D5C6D-DDCF-485D-A1E3-60E55334FD74
Internet Explorer 6 for Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/de...=F91791AC-8185-4346-AA66-89F74D4B5EA7
Internet Explorer 6 SP1 on Windows 98, Windows 98 SE, or Windows Me:
Patches are available from the Windows Update web site.
Provided and/or discovered by:
Andreas Sandblad, Secunia Research.
Initial crash bug discovered by:
Michal Zalewski
Changelog:
2006-04-28: Updated "Description" section to clarify that Secunia has successfully exploited the vulnerability.
2006-05-01: Updated "Description" section. During further analysis, it has become clear that the issue successfully exploited by Secunia is a variant of the issue discovered by Michal Zalewski.
2006-05-05: Added CVE reference.
2006-06-13: Updated advisory with additional information from Microsoft.
2006-06-15: Added link to Secunia Research advisory.
Original Advisory:
MS06-021 (KB916281):
http://www.microsoft.com/technet/security/Bulletin/MS06-021.mspx
Secunia Research:
http://secunia.com/secunia_research/2006-41/
Other References:
KB article discussing known issues when installing the update:
http://support.microsoft.com/kb/916281
US-CERT VU#338828:
http://www.kb.cert.org/vuls/id/338828
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
133 Related Secunia Security Advisories, displaying 10
|
|
|
1. Internet Explorer 6 Window "location" Handling Vulnerability
|
|
2. Internet Explorer "substringData()" Memory Corruption Vulnerability
|
|
3. Internet Explorer "Print Table of Links" Cross-Zone Scripting
|
|
4. Internet Explorer HTTP Request Smuggling/Splitting Vulnerabilities
|
|
5. Internet Explorer FTP Command Injection Vulnerability
|
|
6. Microsoft Internet Explorer Multiple Vulnerabilities
|
|
7. Internet Explorer Multiple Code Execution Vulnerabilities
|
|
8. Microsoft Web Proxy Auto-Discovery Feature Security Issue
|
|
9. Internet Explorer Data Stream Handling Vulnerability
|
|
10. Internet Explorer Unspecified Address Bar Spoofing Vulnerability
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
