Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2010.1176
Vulnerability in Internet Explorer Could Allow Remote Code Execution
23 December 2010
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Internet Explorer 6
Internet Explorer 7
Internet Explorer 8
Publisher: Microsoft
Operating System: Windows XP
Windows Vista
Windows 7
Windows Server 2003
Windows Server 2008
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Mitigation
CVE Names: CVE-2010-3971
Original Bulletin:
http://www.microsoft.com/technet/security/advisory/2488013.mspx
Comment: While Microsoft has yet to release an update correcting this
vulnerability, they have stated that an update will follow either
through their monthly update release process, or via an out-of-cycle
update. Microsoft has in the meantime provided some mitigation to
help aleviate the impact of this vulnerability.
- --------------------------BEGIN INCLUDED TEXT--------------------
Microsoft Security Advisory (2488013)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
Published: December 22, 2010
Version: 1.0
General Information
Executive Summary
Microsoft is investigating new, public reports of a vulnerability in all
supported versions of Internet Explorer. The main impact of the vulnerability
is remote code execution. This advisory contains workarounds and mitigations
for this issue.
The vulnerability exists due to the creation of uninitialized memory during a
CSS function within Internet Explorer. It is possible under certain
conditions for the memory to be leveraged by an attacker using a specially
crafted Web page to gain remote code execution.
On completion of this investigation, Microsoft will take the appropriate
action to protect our customers, which may include providing a solution
through our monthly security update release process, or an out-of-cycle
security update, depending on customer needs. Currently, Microsoft is unaware
of any active exploitation of this vulnerability.
We are actively working with partners in our Microsoft Active Protections
Program (MAPP) and our Microsoft Security Response Alliance (MSRA) programs to
provide information that they can use to provide broader protections to
customers. In addition, we are actively working with partners to monitor the
threat landscape and take action against malicious sites that attempt to
exploit this vulnerability.
Microsoft continues to encourage customers to follow the "Protect Your
Computer" guidance of enabling a firewall, applying all software updates and
installing anti-virus and anti-spyware software. Additional information can
be found at Security at home.
Mitigating Factors:
Protected Mode in Internet Explorer on Windows Vista and later Windows
operating systems helps to limit the impact of currently known exploits. An
attacker who successfully exploits this vulnerability would have very limited
rights on the system.
By default, Internet Explorer on Windows Server 2003 and Windows Server 2008
runs in a restricted mode that is known as Enhanced Security Configuration.
This mode sets the security level for the Internet zone to High. This is a
mitigating factor for Web sites that you have not added to the Internet
Explorer Trusted sites zone. See also Managing Internet Explorer Enhanced
Security Configuration.
By default, all supported versions of Microsoft Outlook, Microsoft Outlook
Express, and Windows Mail open HTML e-mail messages in the Restricted sites
zone, which disables script and ActiveX controls, reducing the risk of an
attacker being able to use this vulnerability to execute malicious code. If a
user clicks a link in an e-mail message, the user could still be vulnerable
to exploitation of this vulnerability through the Web-based attack scenario.
An attacker who successfully exploits this vulnerability could gain the same
user rights as the local user. Users whose accounts are configured to have
fewer user rights on the system could be less affected than users who operate
with administrative user rights.
In a Web-based attack scenario, an attacker could host a Web site that contains
a Web page that is used to exploit this vulnerability. In addition, compromised
Web sites and Web sites that accept or host user-provided content or
advertisements could contain specially crafted content that could exploit this
vulnerability. In all cases, however, an attacker would have no way to force
users to visit these Web sites. Instead, an attacker would have to convince
users to visit the Web site, typically by getting them to click a link in an
e-mail message or Instant Messenger message that takes users to the attackers
Web site.
Issue References
References Identification
CVE Reference CVE-2010-3971
Affected Software
Internet Explorer 6
Internet Explorer 7
Internet Explorer 8
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition
Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition
Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit
Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for
x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for
Itanium-based Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFNEsCG/iFOrG6YcBERAkTSAJ98K1XcybBCpfQI/W2qTqKQLVewCQCg18fl
AB+MZMWwAq1KoyvLA/aT9Go=
=O2LX
-----END PGP SIGNATURE-----