|
 |
|
Internet Explorer flere sårbarheder
|
|
|
|
|
Secunia Advisory:
|
SA25627
|
|
|
Udsendt:
|
2007-06-12
|
|
Sidste Opdt.:
|
2007-06-14
|
|
|
Kritisk:
|
Meget kritisk
|
|
Betydning:
|
Cross Site Scripting
Forfalskning
Systemadgang
|
|
Hvor:
|
Fra Internet
|
|
Løsning Status:
|
Producent Patch
|
|
| Software: | Microsoft Internet Explorer 5.01
Microsoft Internet Explorer 6.x
Microsoft Internet Explorer 7.x
|
| | CVE reference: | CVE-2007-1750 (Secunia mirror)
CVE-2007-1751 (Secunia mirror)
CVE-2007-0218 (Secunia mirror)
CVE-2007-2222 (Secunia mirror)
CVE-2007-3027 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Beskrivelse:
Der er rapporteret flere sårbarheder i Internet Explorer, som kan udnyttes af ondsindede personer til at udføre phishing-angreb eller kompromittere en brugers system.
1) En fejl under instantieringen af urlmon.dll COM-objekter, der ikke er beregner til at blive instantieret i Internet Explorer, kan udnyttes til at korrumpere hukommelsen.
2) En fejl under håndteringen af CSS-tags (Cascading Style Sheet) kan udnyttes til at korrumpere hukommelsen via en specielt udformet webside.
3) En race condition ved installering af flere sprogpakker kan udnyttes til at korrumpere hukommelsen via en specielt udformet webside.
4) En fejl under håndteringen af prototype-variabler der refererer allerede slettede tabel-celler kan udnyttes til at korrumpere hukommelsen via en specielt udformet webside.
5) Ikke-kontrollerede buffere i ActiveListen (XListen.dll) og ActiveVoice (XVoice.dll) ActiveX-kontrollerne i Microsoft Speech under håndteringen af visse metoder eller egenskaber (f.eks. "FindEngine()" metoden) kan udnyttes til at forårsage buffer overflows.
Do you have this product installed on your home computer? Scan using the free Personal Software Inspector. Check if a vulnerable version is installed on computers in your corporate network, using the Network Software Inspector.
Løsning:
Installér patches.
Internet Explorer 5.01 SP4 på Windows 2000 SP4:
http://www.microsoft.com/downloads/de...=3B49F1ED-ABE3-4DBD-A91D-973415658F6B
Internet Explorer 6 SP1 på Windows 2000 SP4:
http://www.microsoft.com/downloads/de...=5C958650-28D2-4DD0-96A8-DBFE79CE3F68
Internet Explorer 6 for Windows XP SP2:
http://www.microsoft.com/downloads/de...=60FB294E-A8E1-405E-A289-2D2723EDF7EE
Internet Explorer 6 for Windows XP Professional x64 Edition (eventuelt med SP2):
http://www.microsoft.com/downloads/de...=086D6D6E-4703-4C6C-A7AF-B6DAFEEEDE5D
Internet Explorer 6 for Windows Server 2003 SP1/SP2:
http://www.microsoft.com/downloads/de...=7ED19127-5C2D-48E4-A8D1-090DC69FD68B
Internet Explorer 6 for Windows Server 2003 x64 Edition (eventuelt med SP2):
http://www.microsoft.com/downloads/de...=1449EB5D-6E4C-4332-8CB6-AB9EE59C9A95
Internet Explorer 6 for Windows Server 2003 for Itanium-baserede systemer SP1/SP2:
http://www.microsoft.com/downloads/de...=B628A3CC-A70C-478A-A10C-EEE254EE34AB
Internet Explorer 7 for Windows XP SP2:
http://www.microsoft.com/downloads/de...=C2191703-8CBD-4959-9F84-E13F21173926
Internet Explorer 7 for Windows XP Professional x64 Edition (optionally with SP2):
http://www.microsoft.com/downloads/de...=69C526B8-8B07-42BC-9BED-E18DEAE21C8E
Internet Explorer 7 for Windows Server 2003 SP1/SP2:
http://www.microsoft.com/downloads/de...=A074D9C0-1FED-4753-845E-073CFCE99F45
Internet Explorer 7 for Windows Server 2003 x64 Edition (eventuelt med SP2):
http://www.microsoft.com/downloads/de...=744ACB43-64DA-48CC-AE69-9386B597EABC
Internet Explorer 7 for Windows Server 2003 for Itanium-baserede systemer SP1/SP2:
http://www.microsoft.com/downloads/de...=069C1560-B5E5-4DFE-A18D-E0507D406028
Internet Explorer 7 for Windows Vista:
http://www.microsoft.com/downloads/de...=77287386-48EB-4AA9-9537-626A3093AAF7
Internet Explorer 7 for Windows Vista x64 Edition:
http://www.microsoft.com/downloads/de...=77287386-48EB-4AA9-9537-626A3093AAF7
Rapporteret af / Kredit:
1) Fundet af en anonym person og rapporteret via iDefense Labs.
2) Rapporteret af producenten.
3) Fundet af en anonym person og rapporteret via ZDI.
4) Fundet af Sam Thomas og rapporteret via ZDI.
5) Fundet uafhængigt af:
* Will Dormann, CERT/CC
* cocoruder, Fortinet Security Research
Forløb:
13-06-2007: Tilføjede yderligere information fra iDefense Labs, ZDI, Fortinet, US-CERT og rgod.
14-06-2007: Tilføjede CVE-reference. Fjernede information om CVE-2007-1752, da denne sårbarhed allerede dækkes af CVE-2007-1499.
Original Advisory:
MS07-033 (KB933566):
http://www.microsoft.com/technet/security/Bulletin/MS07-033.mspx
Fortinet:
http://www.fortiguardcenter.com/advisory/FGA-2007-08.html
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=542
US-CERT VU#507433:
http://www.kb.cert.org/vuls/id/507433
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-07-037.html
http://www.zerodayinitiative.com/advisories/ZDI-07-038.html
Andre Kilder:
SA24535:
http://secunia.com/advisories/24535/
milw0rm:
http://www.milw0rm.com/exploits/4065
http://www.milw0rm.com/exploits/4066
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
134 Relaterede Secunia Advisories, displaying 10
|
|
|
1. Internet Explorer flere sårbarheder
|
|
2. Microsoft "Web Proxy Auto-Discovery" feature sikkerhedsproblem
|
|
3. Internet Explorer uspecificeret addressbar-spoofing
|
|
4. Internet Explorer "OnKeyDown" fokus-svaghed
|
|
5. Microsoft Internet Explorer afsløring af FTP login-oplysninger
|
|
6. Microsoft Internet Explorer flere sårbarheder
|
|
7. Microsoft Windows Vector Markup Language buffer overflow
|
|
8. Internet Explorer "document.open()" adressebar-spoofing
|
|
9. Microsoft Internet Explorer 7 HTTP Basic Authentication IDN-spoofing
|
|
10. Internet Explorer side-loading race condition og URL-spoofing
|
Vis alle relaterede advisories
|
|
|
Send Feedback to Secunia
|
|
Hvis du har ny information angående dette Secunia advisory eller et produkt i vores database, så send det venligst til os. Du kan sende det til os enten ved at bruge vores web formular eller ved at sende det til vuln@secunia.com.
Ideer, foreslag og andet feedback er også meget velkommen.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
