Microsoft Internet Explorer Parsing and State Errors Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015900
|
|
SecurityTracker URL: http://securitytracker.com/id?1015900
|
|
CVE Reference: CVE-2006-1185
, CVE-2006-1186
, CVE-2006-1188
, CVE-2006-1189
, CVE-2006-1190
(Links to External Site)
|
Date: Apr 11 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 5.01 SP4, 6 SP1; and prior service packs
|
Description: Several vulnerabilities were reported in Microsoft Internet Explorer (IE). A remote user can execute arbitrary code on the target system.
A remote user can create specially crafted HTML that, when loaded by the target user, will trigger an error in the HTML parser and
execute arbitrary code on the target user's system [CVE-2006-1185]. The code will run with the privileges of the target user.
A
remote user can create specially crafted TML that, when loaded by the target user, will invoke certain COM objects as ActiveX controls
in a manner that will corrupt system memory and potentially execute arbitrary code [CVE-2006-1186].
A remote code user can create
HTML with specially crafted tag elements that, when loaded by the target user, will execute arbitrary code on the target user's
system [CVE-2006-1188]. The code will run with the privileges of the target user. The vendor indicates that this vulnerability
was previously disclosed [it appears to have been disclosed as a denial of service vulnerability.]
A remote user can create a
URL that contains specially crafted double-byte characters [CVE-2006-1189]. When the URL is loaded by the target user, arbitrary
code may be executed.
A remote user can create specially crafted HTML that dynamically creates an embedded object that uses IOleClientSite
information in making a security decision [CVE-2006-1190]. The HTML can cause the browser to return incorrect IOleClientSite information
and potentially execute the HTML in the wrong security domain. As a result, information may be disclosed or arbitrary code may
be executed.
Microsoft credits Jan P. Monsch of Compass Security Network Computing AG [CVE-2006-1185], Richard M. Smith of Boston
Software Forensics [CVE-2006-1186], Thomas Waldegger [CVE-2006-1188], Sowhat of Nevis Labs [CVE-2006-1189], and Heiko Schultze of
SAP [CVE-2006-1190] with reporting these vulnerabilities.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued the following fixes as part of a cumulative update:
Internet Explorer 5.01 Service Pack 4 on Microsoft Windows
2000 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=594E7B87-AF8F-4346-9164-596E3E5C22B1
Internet
Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 or on Microsoft Windows XP Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=
033C41E1-2B36-4696-987A-099FC57E0129
Internet Explorer 6 for Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=F05FFB31-
E6B4-4771-81F1-4ACCEBF72133
Internet Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack
1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE566871-D217-41D3-BECC-B27FAFA00054
Internet Explorer 6 for Microsoft
Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?Fam
ilyId=E584957C-0ABE-4129-ABAF-AA2852AD62A3
Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?Family
Id=5A1C8BE3-39EE-4937-9BD1-280FC35125C6
Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?Famil
yId=C278FE3E-620A-4BBC-868B-CA2D9EFF7AC3
A restart is required.
The vendor's advisory is available at:
http://www.microsoft.com/technet/security/bulletin/ms06-01
3.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms06-013.mspx (Links to External Site)
|
Cause: Access control error, Exception handling error, State error
|
Underlying OS: Windows (98), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 11 Apr 2006 14:58:43 -0400
Subject: Microsoft Internet Explorer (IE) MS06-013
|
HTML Parsing Vulnerability - CVE-2006-1185
COM Object Instantiation Memory Corruption Vulnerability - CVE-2006-1186
HTML Tag Memory Corruption Vulnerability - CVE-2006-1188
Double Byte Character Parsing Memory Corruption Vulnerability - CVE-2006-1189
Script Execution Vulnerability - CVE-2006-1190
|
|
