MS-ISAC ADVISORY NUMBER:
2008-021
DATE(S) ISSUED:
6/10/2008
SUBJECT:
Vulnerabilities in Internet Explorer Could Allow Remote Code Execution or Information Disclosure
OVERVIEW:
Two vulnerabilities have been discovered in Microsoft Internet Explorer. These vulnerabilities may be exploited if a user visits a web site specifically designed to exploit these vulnerabilities or by visiting a trusted web site unwittingly hosting malicious content. If successfully exploited, these vulnerabilities could allow an attacker to take complete control of an affected system resulting in the attacker gaining the same privileges as the logged on user. If the user is logged in with administrator privileges, the attacker could then install programs, view, change, or delete data, or create new accounts with full privileges. Failed exploit attempts will result in a denial-of-service condition.
SYSTEMS AFFECTED:
- Microsoft Internet Explorer 5.01
- Microsoft Internet Explorer 6
- Microsoft Internet Explorer 7
RISK:
Government:
Large and medium government entities: High
Small government entities: High
Businesses:
Large and medium business entities: High
Small business entities: High
Home users: High
DESCRIPTION:
Two vulnerabilities have been discovered in Microsoft Internet Explorer that could allow an attacker to take complete control of an affected system. Details of these vulnerabilities are as follows:
HTML Objects Memory Corruption Vulnerability
An HTML rendering vulnerability has been discovered which allows an attacker to execute arbitrary code on affected systems. This vulnerability is the result of the way Internet Explorer displays a web page that contains unexpected calls to HTML objects.
Request Header Cross-Domain Information Disclosure Vulnerability
An information disclosure vulnerability has been discovered which allows an attacker to read information from any domain within Internet Explorer. This vulnerability is the result of Internet Explorer incorrectly parsing a specially crafted request header.
Both of these vulnerabilities can be exploited by an attacker if a user visits a specially crafted malicious web site. Successful exploitation could allow an attacker to execute arbitrary code on the affected system. If the user is logged in with administrator privileges, the attacker could then install programs, view, change, or delete data, or create new accounts with full privileges.
RECOMMENDATIONS:
We recommend the following actions be taken:
- Apply appropriate patches provided by Microsoft to vulnerable systems immediately after appropriate testing.
- Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
- Do not visit untrusted websites or follow links provided by unknown or un-trusted sources.
- Read all e-mail messages in plain text.
REFERENCES:
Microsoft:
http://www.microsoft.com/technet/security/bulletin/MS08-031.mspx
Security Focus:
http://www.securityfocus.com/bid/28552
CVE:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1544
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1442
This cyber advisory was issued by the Multi-State Information Sharing and Analysis Center (MS-ISAC) and was intended for government entities. The information may or may not be applicable to the general public and accordingly, the MS-ISAC does not warrant its use for any specific purposes.
-