|
|
|
|
| |
Credit:
The information has been provided by Peter Vreugdenhil.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/
|
| |
Vulnerable Systems:
* Microsoft Internet Explorer version 6
* Microsoft Internet Explorer version 7
* Microsoft Internet Explorer version 8
Immune Systems:
* Microsoft Internet Explorer 5
The vulnerability occurs when the 'ondatasetcomplete' event method of a timeChildren object is referenced. If this occurs when the object is in an inconsistent state, a heap chunk will be freed, and then reused after being freed. This results in an uninitialized VTABLE being used, which can result in the execution of arbitrary code when the pointer is dereferenced.
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the user viewing the web page. To exploit this vulnerability, a targeted user must load a malicious web page created by an attacker. An attacker typically accomplishes this via social engineering or injecting content into compromised, trusted sites. After the user visits the malicious web page, no further user interaction is needed.
Patch Availability:
Microsoft Corp. has released an Out-Of-Band patch which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URL shown:
http://www.microsoft.com/technet/security/Bulletin/MS09-034.mspx
Workaround
Since this vulnerability is triggered through script code, disabling Active Scripting will prevent the exploitation of this vulnerability.
CVE Information:
CVE-2009-1917
Disclosure Timeline:
05/06/2009 - PoC Requested
06/06/2009 - PoC Sent
06/24/2009 - Tentative disclosure set to August
06/25/2009 - Requested CVE from vendor
06/25/2009 - Received CVE from vendor
07/23/2009 - Received updated disclosure notice for OOB in July
07/28/2009 - Coordinated public disclosure
--------------------------------------------------------------------------------------------------------------------------------
Evaluate your site's resistance to the installation of malicious code. Have it scanned for vulnerabilities.
|
|
|
|
|
