MSMVPS.COM

The Ultimate Destination for Blogs by Current and Former Microsoft Most Valuable Professionals.
Welcome to MSMVPS.COM Sign in | Help
in Search

Harry Waldron - Microsoft MVP Blog

Security News and Best Practices for corporate and home users

New Internet Explorer Security Issue - create text range vulnerability

  A newly discovered Internet Explorer security issue has surfaced, but so far there are no known exploits.  Everyone should be careful with email links or websites with any browser. 

New Internet Explorer Security Issue - create text range vulnerability
http://secunia.com/advisories/18680/
http://www.incidents.org/diary.php?storyid=1209

Rating: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched 
Software: Microsoft Internet Explorer 6.x, 7 preview

 
Description:  Secunia Research has discovered a vulnerability in Microsoft Internet Explorer, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an error in the processing of the "createTextRange()" method call applied on a radio button control. This can be exploited by e.g. a malicious web site to corrupt memory in a way, which allows the program flow to be redirected to the heap.

Successful exploitation allows execution of arbitrary code. The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2. The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview. Other versions may also be affected.

Solution: Do not visit untrusted web sites.

Microsoft Response: http://blogs.technet.com/msrc/archive/2006/03/22/422849.aspx

Only published comments... Mar 23 2006, 01:14 AM by Harry Waldron

Leave a Comment

(required) 
(optional)
(required) 
Submit
Powered by Community Server (Commercial Edition), by Telligent Systems