Microsoft Windows IE Multiple Memory Corruption Vulnerabilities

Overview

» IDS/IPS Signatures

Security Sites

iPolicy Networks Security Advisory


Date Discovered:	02/12/2008
Severity:	High
Operating Systems Affected:	Microsoft Windows 2000 SP4 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Microsoft Windows XP Professional x64 SP2 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 x64 Microsoft Windows Server 2003 x64 SP2 Windows Vista Windows Vista x64
Applications Affected:	Internet Explorer 5.01 Internet Explorer 6 Internet Explorer 6 SP1 Internet Explorer 7

Synopsis

Multiple memory corruption vulnerabilities exist in the way internet Explorer in interprets HTML with certain layout combinations, handles a property method, or handles argument validation in image processing. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution.

Recommended Actions

Update the patches as guided by vendor at :
http://www.microsoft.com/technet/security/bulletin/ms08-010.mspx

Threat Analysis

When Internet Explorer handles specially crafted Web pages with certain HTML layout combinations, it may corrupt system memory in such a way that an attacker could execute arbitrary code.

When Internet Explorer calls the property method it may corrupt memory in such a way that an attacker could execute arbitrary code.

Internet Explorer, under certain circumstances in processing images, incorrectly handles validation of data. As a result, memory may be corrupted in such a way that an attacker could execute arbitrary code in the context of the logged-on user. The image processing is performed by the ActiveX control dxtmsft.dll.

An attacker could host a specially crafted Web site that is designed to exploit this vulnerability through Internet Explorer and then convince a user to visit the Web site. This can also include compromised Web sites and Web sites that accept or host user-provided content or advertisements. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged on user.

References

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0076
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0077
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0078

Write-up by: Aditya Chaturvedi

Security Sites

“iPolicy is one of the most visionary firewall vendors in the firewall Magic Quadrant. Its architecture of a central session processing engine and multiple content blades that are able to block based on signatures, rules and so on is the closest to the network security ideal.”

Greg Young, John Pescatore
Magic Quadrant for Network Firewalls, 2H04, Gartner

| | | | | | | | |