Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0001
Vulnerability in Internet Explorer Could Allow Remote Code Execution
2 January 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Internet Explorer
Publisher: Microsoft
Operating System: Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows Server 2008 R2
Windows 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Mitigation
CVE Names: CVE-2012-4792
Reference: http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx
Original Bulletin:
http://technet.microsoft.com/en-us/security/advisory/2794220
- --------------------------BEGIN INCLUDED TEXT--------------------
Microsoft Security Advisory (2794220)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
Published: Saturday, December 29, 2012 | Updated: Monday, December 31, 2012
Version: 1.1
General Information
Executive Summary
Microsoft is investigating public reports of a vulnerability in Internet
Explorer 6, Internet Explorer 7, and Internet Explorer 8. Internet Explorer 9
and Internet Explorer 10 are not affected by the vulnerability. Microsoft is
aware of targeted attacks that attempt to exploit this vulnerability through
Internet Explorer 8. Applying the Microsoft Fix it solution, "MSHTML Shim
Workaround," prevents the exploitation of this issue. See the Suggested
Actions section of this advisory for more information.
The vulnerability is a remote code execution vulnerability that exists in the
way that Internet Explorer accesses an object in memory that has been deleted
or has not been properly allocated. The vulnerability may corrupt memory in a
way that could allow an attacker to execute arbitrary code in the context of
the current user within Internet Explorer. An attacker could host a specially
crafted website that is designed to exploit this vulnerability through
Internet Explorer and then convince a user to view the website.
Advisory Details
Issue References
For more information about this issue, see the following references:
CVE Reference CVE-2012-4792
Microsoft Knowledge Base Article 2794220
Affected Software
Operating System Component
Windows XP Service Pack 3 Internet Explorer 6
Windows XP Professional x64 Edition Service Pack 2 Internet Explorer 6
Windows Server 2003 Service Pack 2 Internet Explorer 6
Windows Server 2003 x64 Edition Service Pack 2 Internet Explorer 6
Windows Server 2003 with SP2 for Itanium-based Systems Internet Explorer 6
Windows XP Service Pack 3 Internet Explorer 7
Windows XP Professional x64 Edition Service Pack 2 Internet Explorer 7
Windows Server 2003 Service Pack 2 Internet Explorer 7
Windows Server 2003 x64 Edition Service Pack 2 Internet Explorer 7
Windows Server 2003 with SP2 for Itanium-based Systems Internet Explorer 7
Windows Vista Service Pack 2 Internet Explorer 7
Windows Vista x64 Edition Service Pack 2 Internet Explorer 7
Windows Server 2008 for 32-bit Systems Service Pack 2 Internet Explorer 7
Windows Server 2008 for x64-based Systems SP 2 Internet Explorer 7
Windows Server 2008 for Itanium-based Systems SP 2 Internet Explorer 7
Windows XP Service Pack 3 Internet Explorer 8
Windows XP Professional x64 Edition Service Pack 2 Internet Explorer 8
Windows Server 2003 Service Pack 2 Internet Explorer 8
Windows Server 2003 x64 Edition Service Pack 2 Internet Explorer 8
Windows Vista Service Pack 2 Internet Explorer 8
Windows Vista x64 Edition Service Pack 2 Internet Explorer 8
Windows Server 2008 for 32-bit Systems Service Pack 2 Internet Explorer 8
Windows Server 2008 for x64-based Systems SP 2 Internet Explorer 8
Windows 7 for 32-bit Systems Internet Explorer 8
Windows 7 for 32-bit Systems Service Pack 1 Internet Explorer 8
Windows 7 for x64-based Systems Internet Explorer 8
Windows 7 for x64-based Systems Service Pack 1 Internet Explorer 8
Windows Server 2008 R2 for x64-based Systems Internet Explorer 8
Windows Server 2008 R2 for x64-based Systems SP 1 Internet Explorer 8
Windows Server 2008 R2 for Itanium-based Systems Internet Explorer 8
Windows Server 2008 R2 for Itanium-based Systems SP 1 Internet Explorer 8
Suggested Actions
Workarounds
Apply the Microsoft Fix it solution, "MSHTML Shim Workaround", that prevents
exploitation of this issue. For further details refer to:
http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUOOJNO4yVqjM2NGpAQKexg/+O0RKUJ/nN0958nEEqQhXn5axtQa1Jw8i
hoMIfrBP5cCdfMp00lXF4XgXguwAwEeI33hLD35fYp5pBzZUZnvFLl9mUlrJjw3O
LiU6MRt3Rxn2ad9cBeyCpI5MkxTBGt2sBoeqfWX4vuuEw2whJie8K2+dyYX+tE4P
zRlCPJNFEFGNp1Q5Y2fgsfrAiUjAdNZpL7j7bms/eOQmOxkakZPfMfVFGnsvpkTb
GMJOFYw78D9ly9cGZv21SKKYly2jTaDKkTev61PP6K8dutL2pYwPU8JlLiPavL4C
+EDRw4XYTlQP3iFK90m+5ijq5il4qbhl89hxJWMnQAe9CG6jv2VR1obp0if8En5W
/ie9lud84TkH13ew+VvZoy/ZDux5Y+K2+XnTPjU80ZSA147qfrMFA2eG0muS8y4R
26TIa3NssPQpa/ZCLfSWlvsvKL6mqgB1IG0AhyM5BIZ79ZvfXu55OUKCJAVkjMSw
f4KZs4bxFsvWEqbbwXJUGmQKI/i0e/lHRpc1/UhmQOpKDmXlmQ508GrsL+Z32EfC
phmHqvu5n50ewgPQYydKXZTdA36ux04mxwh42AgS0mCWHRnumbEc0k+uAGNhz5R2
DPaSSLfYnQu4Bzd9sONeVKi7kz7kHj0MnHDuJQ/4mybdXUnIpgqtnlmF0G4pK0ra
XOb+EUZE6JY=
=IFLx
-----END PGP SIGNATURE-----