Internet Explorer Multiple Code Execution Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

Internet Explorer Multiple Code Execution Vulnerabilities
Secunia Advisory:	SA28036	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2007-12-11
Last Update:	2007-12-19
Popularity:	25,970 views

Critical:	Extremely critical
Impact:	System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	Microsoft Internet Explorer 5.01 Microsoft Internet Explorer 6.x Microsoft Internet Explorer 7.x

Binary Analysis:	BA321 :: Available for 1 Credit BA320 :: Available for 1 Credit

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2007-3902 CVE-2007-3903 CVE-2007-5344 CVE-2007-5347

Description: Some vulnerabilities have been reported in Internet Explorer, which can be exploited by malicious people to compromise a user's system. 1) A use-after-free error in mshtml.dll when handling "setExpression()" method calls can be exploited to dereference previously freed memory via a malicious web page containing specially crafted script code. 2) An error within the handling of the "cloneNode()" and "nodeValue()" methods can be exploited to corrupt memory via a malicious web page containing specially crafted script code. 3) An error when handling document objects that have been created, modified, deleted, and are then accessed can be exploited to corrupt memory via a malicious web page containing specially crafted script code. 4) An error when displaying web pages containing certain unexpected method calls to HTML objects can be exploited to corrupt memory. NOTE: This vulnerability is reportedly being actively exploited. Successful exploitation of the vulnerabilities allows execution of arbitrary code when a user e.g. visits a malicious website. Solution: Apply patches. Windows 2000 SP4 with Internet Explorer 5.01 SP4: http://www.microsoft.com/downloads/de...=B3BD16EA-5D69-4AE3-84B3-AB773052CEEB Windows 2000 SP4 with Internet Explorer 6 SP1: http://www.microsoft.com/downloads/de...=BC8EDF05-262A-4D1D-B196-4FC1A844970C Windows XP SP2 with Internet Explorer 6: http://www.microsoft.com/downloads/de...=6E4EBAFC-34C3-4DC7-B712-152C611D3F0A Windows XP Professional x64 Edition (optionally with SP2) and Internet Explorer 6: http://www.microsoft.com/downloads/de...=F5A5AF23-30FB-4E47-94BD-3B05B55C92F2 Windows Server 2003 SP1/SP2 with Internet Explorer 6: http://www.microsoft.com/downloads/de...=BF466060-A585-4C2E-A48D-70E080C3BBE7 Windows Server 2003 x64 Edition (optionally with SP2) and Internet Explorer 6: http://www.microsoft.com/downloads/de...=074697F2-18C8-4521-BBF7-1D0E7395D27D Windows Server 2003 with SP1/SP2 for Itanium-based systems and Internet Explorer 6: http://www.microsoft.com/downloads/de...=B3F390A6-0361-4553-B627-5E7AD6BF5055 Windows XP SP2 with Internet Explorer 7: http://www.microsoft.com/downloads/de...=B15A6506-02DD-43C2-AEF4-E10C1C76EE97 Windows XP Professional x64 Edition (optionally with SP2) and Internet Explorer 7: http://www.microsoft.com/downloads/de...=C092A6BB-8E62-4D90-BDB1-5F3A15968F75 Windows Server 2003 SP1/SP2 with Internet Explorer 7: http://www.microsoft.com/downloads/de...=34759C10-16A5-42A2-974D-9D532FB5A0A7 Windows Server 2003 x64 Edition (optionally with SP2) and Internet Explorer 7: http://www.microsoft.com/downloads/de...=7DCCCE5A-7562-448B-A345-CF1CC758E35C Windows Server 2003 with SP1/SP2 for Itanium-based systems and Internet Explorer 7: http://www.microsoft.com/downloads/de...=8414F3FB-216A-4D46-B590-4C1F304DFF91 Windows Vista with Internet Explorer 7: http://www.microsoft.com/downloads/de...=26D303DA-BB2E-4555-96F1-BECB0E277341 Windows Vista x64 Edition with Internet Explorer 7: http://www.microsoft.com/downloads/de...=C5E88E0B-A4C2-4690-91D9-326800030A16 Provided and/or discovered by: 1) Independently discovered by: * An anonymous person via ZDI. * Peter Vreugdenhil via iDefense VCP. 2) Reported by Sam Thomas via Zero Day Initiative. 3) Reported by Peter Vreugdenhil via Zero Day Initiative. 4) Reported as a 0-day. Changelog: 2007-12-12: Added information from ZDI. 2007-12-13: Added link to iDefense Labs. 2007-12-19: Updated "Extended Solution" section. Original Advisory: MS07-069 (KB942615): http://www.microsoft.com/technet/security/Bulletin/MS07-069.mspx ZDI: http://www.zerodayinitiative.com/advisories/ZDI-07-073.html http://www.zerodayinitiative.com/advisories/ZDI-07-074.html http://www.zerodayinitiative.com/advisories/ZDI-07-075.html iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=631 Extended Solution: The "Extended Solution" section is available for Secunia customers only. Request a trial and get access to the Secunia Customer Area and Extended Secunia advisories.

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

3rd Dec, 2008

New advisories:	24
New vulnerabilities:	39
Updated advisories:	41

Moderately // 208 views

mvnForum Unspecified Cross-Site Scripting and Request Forgery

Less // 207 views

Debian update for awstats

Moderately // 214 views

Kolab Server ClamAV Multiple Vulnerabilities

Less // 274 views

Movable Type Unspecified Cross-Site Scripting Vulnerability

Moderately // 253 views

Sunbyte e-Flower "id" SQL Injection Vulnerability

Not // 283 views

SUSE update for kernel

Not // 371 views

HP-UX Unspecified Local Denial of Service Vulnerability

Moderately // 322 views

WebGUI Executable Attachments Vulnerability

Moderately // 485 views

SquirrelMail Malformed HTML Mail Message Script Insertion

Less // 485 views

VMware ESX Server update for bzip2

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.