Microsoft Internet Explorer - Heap Memory Corruption Vulnerability
Description
Internet Explorer is the flagship browser for the Microsoft Windows OS.
A vulnerability has been discovered in IE5.x and IE6.x that allows an attacker to effectively corrupt the allocated memory space and cause IE to crash upon successful exploitation. Microsoft later acknowledged the issue and confirmed the vulnerability is an exploitable heap overflow vulnerability which ultimately gives an attacker the luxury to execute arbitrary code against IE users.
Summary
- Product
- Internet Explorer
- Vendor
- Microsoft
- Affected Versions
- 5.x up to SP3 inclusive, up to 6.1 SP1 inclusive
- Severity
- HIGH
- Identifier
- N/A
- Tested Platform
- Windows 2000, Windows XP
Impact
Execute Arbitrary Code
Detail
[Vulnerability] Cascading Style Sheets(CSS) Memory Corruption
Cascading Style Sheets (CSS) is a technology that allows Web authors to have increased control of the design and interaction of their Web pages. The issue arises when IE is presented a STYLE tag followed by a sequence of comment character /* that is not terminated, which triggers IE to perform an invalid memory copy operation, for example:
<STYLE>@;/*
The attacker can simply cause a Denial of Service and crash the vulnerable IE versions by constructing a malicious web page that has the <STYLE>@;/* embedded. The attacker needs to use merely 11 bytes to crash a 20mb software package.
Proof of Concept
For demonstration purposes, we also construct a sample page here http://www.ecqurity.com/adv/11.html (visiting 11.html will crash your IE without any warning, make sure you save whatever you're doing first before visiting the page).
Additionally, a more sophisticated exploit can also be crafted to have the malicious code executed in the context of the IE user whenever the malicious web page is loaded. For the exploit to work, the attacker only needs to entice the users to visit the malicious page.
Vendor Status
Microsoft acknowledged the issue and released a patch on the October 12th, 2004. For more information about the patch and where you can download it, please visit http://www.microsoft.com/technet/security/bulletin/ms04-038.mspx
Disclosure Timeline
- Date
- Summary
- N/A
Credit
Phuong Nguyen (ECQ)
David Coomber (ECQ)