Microsoft IE mshtml.dll Multiple Script Action Handler Overflow
OSVDB ID: 23964
Disclosure Date: Mar 16, 2006
Description:
Remote overflow exists in Microsoft Internet Explorer. The product fails to properly check bounds for handling HTML tags with multiple event handlers resulting in a buffer overflow. With a specially crafted HTML document, an attacker can cause affected web browsers to crash or remote code execution resulting in a loss of integrity, and/or availability.
Vulnerability Classification:
Remote/Network Access Required
Denial Of Service Attack
Input Manipulation
Loss Of Integrity
Loss Of Availability
Exploit Available
Verified
Products:
Microsoft Corporation Internet Explorer 6.0 SP2
Microsoft Corporation Internet Explorer 7.0 beta 2
Microsoft Corporation Internet Explorer 7.0 beta 1
Solution:
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
Manual Testing Notes:
The following HTML content demonstrates this issue by crashing the browser:
<script>
for(s='<a onclick=',i=0;i<8||(document.write(s+'>'));i++)s+=s;
</script>
External References:
Snort Signature ID: http://www.snort.org/pub-bin/sigs.cgi?sid=100000238
CVE ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-1245
National Vulnerability Database: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-1245
Bugtraq ID: http://www.securityfocus.com/bid/17131
Microsoft Security Bulletin: http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx
Generic Exploit URL: http://lcamtuf.coredump.cx/iedie.html
ISS X-Force ID: http://xforce.iss.net/xforce/xfdb/25292
Secunia Advisory ID: http://secunia.com/advisories/18957
Secunia Advisory ID: http://secunia.com/advisories/19269
Microsoft Knowledge Base Article: http://support.microsoft.com/default.aspx?scid=kb;EN-US;912812
Other Solution URL: http://snort.org/rules/advisories/ie-issue-js-v2.txt
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-03/0303.html
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-03/0304.html
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-03/0310.html
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-03/0325.html
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-12/0048.html
Security Tracker: http://securitytracker.com/id?1015794
Credit:
Michal Zalewski (lcamtuf@dione.ids.pl) - Personal page (http://lcamtuf.coredump.cx/)
Labels: Advisory, Bug, http, Microsoft
Microsoft Office and Excel Buffer Overflows Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID: 1015766
SecurityTracker URL:
http://securitytracker.com/id?1015766 CVE Reference: CVE-2005-4131 , CVE-2006-0009 , CVE-2006-0028 , CVE-2006-0029 , CVE-2006-0030 , CVE-2006-0031
Updated: Mar 14 2006
Original Entry Date: Mar 14 2006
Impact: Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Advisory: Microsoft Security Bulletin
Description: Several vulnerabilities were reported in various components of Microsoft Office. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted document that, when loaded by the target user, will trigger a buffer overflow and execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
An Excel document with a specially crafted range can cause arbitrary code to be executed on the target system [CVE-2005-4131]. [Editor's note: This vulnerability was previously disclosed in Alert ID 1015333.]
A specially crafted routing slip within an Office document can cause arbitrary code to be executed on the target system [CVE-2006-0009].
An Excel document with a specially crafted parsing format file can cause arbitrary code to be executed on the target system [CVE-2006-0028].
An Excel document with a specially crafted description can cause arbitrary code to be executed on the target system [CVE-2006-0029].
An Excel document with a specially crafted graphic can cause arbitrary code to be executed on the target system [CVE-2006-0030].
An Excel document with a specially crafted record can cause arbitrary code to be executed on the target system [CVE-2006-0031].
Microsoft Office 2000 SP3, Microsoft Office XP SP3, Microsoft Office 2003 SP1 or SP2, Microsoft Works Suite 2000, 2001, 2002, 2003, 2004, 2005, and 2006, Microsoft Office X for Mac, and Microsoft Office 2004 for Mac are affected.
Microsoft Office Excel 2000 Viewer, Microsoft Office Excel 2002 Viewer, Microsoft Word 2003, Microsoft Outlook 2003, and Microsoft PowerPoint 2003 are not affected.
Microsoft credits Ollie Whitehouse of Symantec [CVE-2006-0009], FelicioX [CVE-2005-4131], Peter Winter-Smith of NGS Software [CVE-2005-4131], TippingPoint and the Zero Day Initiative [CVE-2006-0028], Dejun of the Fortinet Security Response Team [CVE-2006-0029], and Eyas of the XFOCUS Security Team [CVE-2006-0031] with reporting these vulnerabilities.
Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
Solution: The vendor has issued the following fixes:
Microsoft Word 2000:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CD2179FD-37F5-4D09-B653-0174651CF5E4
Microsoft Excel 2000:
http://www.microsoft.com/downloads/details.aspx?FamilyId=C9433440-31EF-4C18-A0C7-B595EA23F6FC
Microsoft Outlook 2000:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2B231231-AC83-4688-9C8D-DCDCB544FB3C
Microsoft PowerPoint 2000:
http://www.microsoft.com/downloads/details.aspx?FamilyId=F24D4BD0-4771-4688-B52A-02D4EABB1574
Microsoft Office 2000 MultiLanguage Packs:
http://www.microsoft.com/downloads/details.aspx?FamilyId=0AAA1700-766F-4979-B51F-AAA0A24EF2E8
Microsoft Word 2002:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8B98A5FE-7A26-45F0-8D28-C9618FA7A458&displaylang=en
Microsoft Excel 2002:
http://www.microsoft.com/downloads/details.aspx?FamilyId=643337C7-8A47-4FA3-AB58-7A916B33607D&displaylang=en
Microsoft Outlook 2002:
http://www.microsoft.com/downloads/details.aspx?FamilyId=9B0D4441-4F88-4B59-A4F3-6FB558EF8135
Microsoft PowerPoint 2002:
http://www.microsoft.com/downloads/details.aspx?FamilyId=C74CB45B-CF92-4EFC-8DBE-DBF4BDEBE215
Microsoft Office XP Multilingual User Interface Packs:
http://www.microsoft.com/downloads/details.aspx?FamilyId=589D9ABB-6308-4208-881C-CE58D6972E1F&displaylang=en
Microsoft Excel 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=AC22F83A-B409-4469-984E-6C19D8F5FE41&displaylang=en
Microsoft Excel 2003 Viewer:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7DBADBD1-0542-475B-91B5-90DD2AF2C0FC&displaylang=en
Microsoft Works Suite 2000:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CD2179FD-37F5-4D09-B653-0174651CF5E4&displaylang=en
Microsoft Works Suite 2001:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CD2179FD-37F5-4D09-B653-0174651CF5E4&displaylang=en
Microsoft Works Suite 2002:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8B98A5FE-7A26-45F0-8D28-C9618FA7A458&displaylang=en
Microsoft Works Suite 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8B98A5FE-7A26-45F0-8D28-C9618FA7A458&displaylang=en
Microsoft Works Suite 2004:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8B98A5FE-7A26-45F0-8D28-C9618FA7A458&displaylang=en
Microsoft Works Suite 2005:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8B98A5FE-7A26-45F0-8D28-C9618FA7A458&displaylang=en
Microsoft Works Suite 2006:
http://www.microsoft.com/downloads/details.aspx?FamilyId=8B98A5FE-7A26-45F0-8D28-C9618FA7A458&displaylang=en
Microsoft Office X for Mac:
http://www.microsoft.com/mac/
Microsoft Office 2004 for Mac:
http://www.microsoft.com/mac/
The fixes in this bulletin replace some fixes in MS04-033, MS05-012, MS05-035, MS06-003, and MS06-010.
A restart may be required.
The vendor's advisory is available at:
http://www.microsoft.com/technet/security/Bulletin/MS06-012.mspx
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS06-012.mspx
Cause: Boundary error
Underlying OS: UNIX (OS X), Windows (2000), Windows (2003), Windows (XP)
Labels: Advisory, Bug, Microsoft, Vulnerability
OSVDB ID: 23939
Disclosure Date: Mar 17, 2006
Description:
BorderWare MXtreme contains a flaw related to the web administration interface. No further details have been provided.
Vulnerability Classification:
Remote/Network Access Required
Unknown Attack Type
Loss Unknown
Exploit Unavailable
Verified
Web Related
Products:
BorderWare Technologies Inc. MXtreme Mail Firewall 5.0
BorderWare Technologies Inc. MXtreme Mail Firewall 6.0
Solution:
Apply the patch provided by BorderWare, as it has been reported to fix this vulnerability. In addition, the vendor recommends disabling HTTP/HTTPS login access until patches can be applied.
External References:
CVE ID: 2006-1254
National Vulnerability Database: CVE-2006-1254
Bugtraq ID: 17140
Secunia Advisory ID: 19223
Security Tracker: 1015787
FrSIRT Advisory: ADV-2006-0972
Credit:
OSVDB does not have information on who discovered this vulnerability. If you have credit information please send it to OSVDB Moderators
Labels: Advisory, Appliance, Bug, Vulnerability