Security Advisory : CT22-03-2006

Microsoft Internet Explorer (mshtml.dll) Remote Code Execution
 

Affected Software: Microsoft Internet Explorer 6.x & 7 Beta 2
Severity: Critical
Impact: Remote System Access
Solution Status: Unpatched
CVE Reference: Awaiting Confirmation
Advisory Date: 22nd March, 2006
   
   



1. OVERVIEW

Pursuant to the publication of the aforementioned bug/vulnerability, this document serves as a preliminary Security Advisory for users of Microsoft Internet Explorer 6 and 7 Beta 2.

Successful exploitation will allow a remote attacker to execute arbitrary code against a fully patched Windows XP system, yeilding system access with privileges of the underlying user.



2. TECHNICAL NARRATIVE

As per the publication, the bug originates from the use of a createTextRange() method, which, under certain circumstances, can lead to an invalid/corrupt table pointer dereference.

As a result, IE encounters an exception when trying to call a deferenced 32bit address, as highlighted by the following sniplet of code.

0x7D53C15D MOV ECX, DWORD PTR DS:[EDI]
..
0x7D53C166 CALL DWORD PTR [ECX]

Due to the incorrect reference, ECX points to a very remote, non-existent memory location, causing IE to crash (DoS). However, although the location is some what distant, history dictates that a condition of this nature is conducive towards
reliable exploitation.
 


3. PROOF OF CONCEPT

Computer Terrorism (UK) can confirm the production of reliable proof of concept (PoC) for this vulnerability (tested on Windows XP SP2). However, until a patch is developed, we will NOT be publicly disclosing our research.


 

4. TEMPORARY SOLUTION

Users are advised to disable active scripting for non-trusted sites until a patch is released.

 

5. VENDOR STATUS

The Vendor has been informed of all aspects of this new vulnerability (including PoC), but as of the date of the document, this vulnerability is UNPATCHED.


 

5. REFERENCES

Originally Discovered @ http://www.shog9.com/crashIE.html

Subsequent postings @

http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044297.html


Computer Terrorism (UK) :: Incident Response Centre.




 

Home | Contact Us | Services | News

   

CT09-01-2007
Microsoft Outlook
Vulnerability
...........................................


CT12-09-2006
Adobe Flash Player
Vulnerability
...........................................

 


CT12-09-2006-2
Microsoft Publisher

Font Parsing Vulnerability
...........................................

 


CT22-03-2006
Microsoft Internet Explorer CreateText-Range
Vulnerability

...........................................

 


CT21-11-2005
Internet Explorer Javascript Window() Vulnerability

...........................................

 


CT21-11-2005 PoC
...........................................

 


MS Jet Exploit (unpatched)
...........................................

 


Forthcoming advisories
...........................................