MS-ISAC ADVISORY NUMBER:
2005-014

DATE(S) ISSUED:
8/9/2005

SUBJECT:
Cumulative Security Update for Internet Explorer

OVERVIEW:

Microsoft has just released a Security Bulletin (MS05-038) which announces a cumulative security update for Internet Explorer and addresses three new vulnerabilities (see description below). If the most severe of these vulnerabilities is exploited, an attacker can completely take control of a user's system by sending a specially formed image in an email message or causing the user to connect to a malicious website.

SYSTEMS AFFECTED:

  • Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
  • Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4
  • Internet Explorer 6 Service Pack 1 on Microsoft Windows XP Service Pack 1
  • Internet Explorer 6 for Microsoft Windows XP Service Pack 2
  • Internet Explorer 6 for Microsoft Windows Server 2003
  • Internet Explorer 6 for Microsoft Windows Server 2003 Service Pack 1
  • Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems
  • Internet Explorer 6 for Microsoft Windows Server 2003 with SP1 for Itanium
  • Internet Explorer 6 for Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
  • Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition
  • Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition
  • Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium Edition
  • Internet Explorer 6 Service Pack 1 on Microsoft Windows 98
  • Internet Explorer 6 Service Pack 1 on Microsoft Windows 98 SE
  • Internet Explorer 6 Service Pack 1 on Microsoft Windows Millennium Edition

RISK:
Government:

  • Large and medium government entities: High
  • Small government entities: High

Businesses:

  • Large and medium business entities: High
  • Small business entities: High

Home users: High

DESCRIPTION:
The three new vulnerabilities addressed in this update are as follows:

JPEG Image Rendering Memory Corruption Vulnerability
A new vulnerability was discovered in Microsoft Internet Explorer, which could be exploited by remote attackers to execute arbitrary commands. This flaw is due to an error in the way that Internet Explorer handles JPEG images. This could be exploited via a malicious web page or through HTML-formatted email messages that contained a specially crafted JPEG image. If compromised, an attacker could take complete control of the system under the same privileges as the current local user.

Web Folder Behaviors Cross-Domain Vulnerability
A cross-domain vulnerability is present in Microsoft Internet Explorer which, if exploited, could allow remote code execution on the host machine. An attacker can entice a user to visit a maliciously crafted Web site designed to exploit this vulnerability. Once the host was compromised, the intruder would have the same rights as the current local user and have complete control of the host system.

COM Object Instantiation Memory Corruption Vulnerability
There is a vulnerability in the handling of COM objects that are not designed to be used with Microsoft Internet Explorer. In order to exploit this vulnerability, a specifically designed Web page would be used to attract unsuspecting users and compromising those hosts. An attacker could execute commands on the vulnerable host at the same permission level as the current user and possibly take control of the entire system.

RECOMMENDATIONS:
CSCIC recommends the following actions be taken:

REFERENCES:

Microsoft
 http://www.microsoft.com/technet/security/bulletin/MS05-038.mspx(New Window)

Secunia
 http://secunia.com/advisories/16373/(New Window)

FrSIRT
 http://www.frsirt.com/english/advisories/2005/1353(New Window)

 


This cyber advisory was issued by the Multi-State Information Sharing and Analysis Center (MS-ISAC) and was intended for government entities. The information may or may not be applicable to the general public and accordingly, the MS-ISAC does not warrant its use for any specific purposes.