November 10, 2004 October is Koufax Pledge Drive month

Our friends in Redmond ...

Another reason to dump IE for FF, see sidebar.

Technical Cyber Security Alert TA04-315A Buffer Overflow in Microsoft Internet Explorer

Original release date: November 10, 2004
Last revised: --
Source: US-CERT

Systems Affected


  • Microsoft Windows systems running

    • Internet Explorer versions 6.0 and later; previous versions of Internet Explorer may also be affected

    • Other programs that host the WebBrowser ActiveX control


Overview

Microsoft Internet Explorer (IE) contains a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code with the privileges of the user running IE.

However, if heap memory is prepared in a special manner, an attacker could execute arbitrary code more easily. Publicly observed exploits use scripting to prepare the heap, though this may be accomplished without scripting. Without the ability to prepare the heap, the impact is most likely limited to denial of service.

This vulnerability is described in further detail in VU#842160.

II. Impact

By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message), an attacker could execute arbitrary code with the privileges of the user. The attacker could also cause IE (or any program that hosts the WebBrowser ActiveX control) to crash.

Reports indicate that this vulnerability is being exploited by malicious code propagated via email. When a user clicks on a URL in a malicious email message, IE opens and displays an HTML document that exploits the vulnerability. This malicious code may be referred to as MyDoom.{AG,AH,AI} or Bofra.


Yup. Its MyDoom time again. Its been over 10 years since K and I spoke, and it still amazes me that from that late night call the Meadies sprung for the public CERT function and budget, and there are CERTs all over the post-HTRD .mil landscape. The full announcement is here.

Posted by EBW at November 10, 2004 06:45 PM | TrackBack
Comments