NIST IT Security: Internet Explorer XML Exploit Allows Remote Code Execution

NIST Site Search

Product Research

Advertise on this site

Headlines

US-CERT Current Activity

»	Insecure Loading of Dynamic Link Libraries in Windows Applications
»	VMware Releases Updates for ESX Service Console Packages
»	Cisco Releases Security Advisory for IOS XR Software Border Gateway Protocol
»	RealNetworks Releases Update to Address Vulnerabilities in RealPlayer
»	Cisco Releases Advisories for Unified Communications Manager and Unified Presence
»	APWG Fax Back Phishing Education Program
»	Adobe Releases Security Bulletin for Shockwave Player
»	Apple Releases Security Update 2010-005
»	Microsoft Releases Security Advisory
»	VideoLAN Releases a Security Advisory for VLC Media Player

Date published: not known
Details

DOE-CIRC Updates

»	T-430: Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code
»	T-429: WaspTime MS-SQL Database instance with blank password for sa account WaspTime MS-SQL Database instance with blank password for sa account
»	T-428: Vulnerability in Help and Support Center Vulnerability in Help and Support Center
»	T-427: VMWare WebAccess Vulnerability VMWare WebAccess Vulnerability
»	T-426: Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability
»	T-425: Desktop Java running in web browsers Desktop Java running in web browsers
»	T-424: Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service
»	T-423: Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution
»	T-422: Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability
»	T-421: Multiple CACTI Security Vulnerabilities Multiple CACTI Security Vulnerabilities
»	T-420: Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability
»	T-419: PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability PHP 'ibase_gen_id()' Function off-by-one Buffer Overflow Vulnerability
»	T-418: Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability Adobe Acrobat and Reader Font Parsing Remote Code Execution Vulnerability
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities
»	T-417: Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities Apache HTTP Server Multiple Remote Denial of Service Vulnerabilities

Date published: not known
Details

Virus Bulletin news

»	ARF published as IETF standard Abuse report format helps auto-handling of email complaints
»	Microsoft releases new fix for DLL vulnerability Earlier workaround believed to be too complex for most users.
»	Malicious tweets link to fake TweetDeck update Twitter resets passwords for accounts that appear to have been hacked.
»	94% of Internet users befriend unknown 'good-looking woman' Sensitiva data shared after two-hour chat.
»	Investment boost for Quick Heal Indian security firm gets hefty cash injection.
»	41% of spam sent via Rustock botnet Botnet spam back after short summer break.
»	Avast gets $100m investment boost Growth equity firm invests in Czech firm
»	Computer chip giant buys AV giant Intel becomes new owner of McAfee for the princely sum of $7.8bn
»	AV-Test.org issues latest round of testing results Symantec and Microsoft outdo Trend and McAfee in live tests.

Date published: not known
Details

DarkReading - All Stories

»	Networked Scanners Offer A Window Into The Enterprise, Researcher Says Emerging Web-based features make it possible to capture document contents remotely from networked sc ...
»	U.S. Businesses Could Lose Up To $1 Billion In Online Banking Fraud This Year Small- to midsized businesses taking the biggest hit, experts say, but consumer banking customers co ...
»	Product Watch: Verizon, VMware Team Up With Hybrid Cloud Service New Verizon service offers private public-cloud option
»	Could USB Flash Drives Be Your Enterprise's Weakest Link? The Pentagon last week conceded that a USB flash drive carried an attack program inside a classified ...
»	Delaware Contractor Mistakenly Posts Personal Data Of 22,000 Employees State of Delaware contractor Aon mistakenly posts personal data of 22,000 retirees without randomiza ...
»	IBM Corrects Unpatched Vulnerability Numbers After Google Challenge X-Force Team at IBM revises data on vendors with most unpatched bugs in recent IBM X-Force 2010 Mid- ...
»	Major Disruption of Pushdo Botnet Wasn't The Original Goal Botnet's spam traffic cut by 80 percent
»	China, Taiwan Nab 450 Suspects In Biggest Fraud Raid Ever Law enforcement authorities in China, Taiwan seize cash, fraud "manuals" from alleged tele ...
»	Four Best Practices For Tokenization Going beyond Visa's best practices guide

Date published: not known
Details

Internet Explorer XML Exploit Allows Remote Code Execution

Released the day after patch Tuesday this Extremely Critical IE exploit is completely different than the IE vulnerability fixed in the Dec 9th patch. This one allows remote code execution if the user visits a web page containing a specially crafted XML document.

This vulnerability is being actively exploited.

Initial reports said that this vulnerability only affected IE7 but the latest reports indicate that all versions of Internet Explorer since 5.01 (including IE8 Beta 2) on all supported versions of Windows are probably vulnerable as well.

There have been many reports of web sites being compromised through SQL Injection in order to post Javascript that loads this code. Besides using a safer browser (see below) there isn't much you can do except stay away from untrusted sites and hope your trusted sites aren't compromised.

Mitigating Factors:

Protected Mode in Internet Explorer 7 and Internet Explorer 8 Beta 2 in Windows Vista limits the impact of the vulnerability. Enabling DEP in Internet Explorer 7 on Windows Vista can help mitigate this vulnerability by making it more difficult to achieve code execution using this vulnerability.
By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. This mode sets the security level for the Internet zone to High. This is a mitigating factor for Web sites that you have not added to the Internet Explorer Trusted sites zone.
An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
Currently known attacks cannot exploit this issue automatically through e-mail.
This vulnerability can be mitigated by disabling Active Scripting in the Internet Zone, as specified in the "Securing Your Web Browser" document. Note that this will not block the vulnerability. IE still may crash when parsing specially-crafted XML content. Disabling Active Scripting will mitigate a common method used to achieve code execution with this vulnerability.
Do not browse untrusted websites or follow untrusted links.
Use another web browser, such as Firefox, Safari, or Opera

The next Patch Tuesday is scheduled for January 13.

References:

Microsoft Security Advisory (961051) - Vulnerability in Internet Explorer Could Allow Remote Code Execution
US-CERT.GOV: Vulnerability Note VU#493881 - Microsoft Internet Explorer contains an invalid pointer vulnerability in its data binding code. This flaw can cause an invalid array size and result in the accessing of memory space of a deleted object. Specially-crafted XML content that performs data binding can cause IE to crash in a way that is exploitable. Limited testing has shown this vulnerability to affect Internet Explorer 7 and later, up to and including Internet Explorer 8 Beta 2. However, all versions of Internet Explorer from 4.0 and on may be at risk. We have confirmed that Outlook Express is also at risk. Exploit code for this vulnerability is publicly available.
Secunia - Listed as "Extremely Critical.
McAfee Avert Labs Blog - Downloader Trojan Exploits Hole in IE 7
CNET - Microsoft: Hole exploit endangers all IE versions- "An unpatched security hole in Internet Explorer that is being exploited affects all versions of the browser, making it more serious than originally believed when it was first publicized two days ago, Microsoft says."
CVE-2008-4844