Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability

Bugtraq ID:	20096
Class:	Boundary Condition Error
CVE:	CVE-2006-4868
Remote:	Yes
Local:	No
Published:	Sep 19 2006 12:00AM
Updated:	May 15 2007 08:48PM
Credit:	Sunbelt Software is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 0 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Beta 1 Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows 2000 Server SP4 Microsoft Windows 2000 Server SP3 Microsoft Windows 2000 Server SP2 Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server + Avaya DefinityOne Media Servers + Avaya IP600 Media Servers + Avaya S3400 Message Application Server 0 + Avaya S8100 Media Servers 0 Microsoft Windows 2000 Professional SP4 Microsoft Windows 2000 Professional SP3 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional Microsoft Windows 2000 Datacenter Server SP4 Microsoft Windows 2000 Datacenter Server SP3 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Advanced Server SP4 Microsoft Windows 2000 Advanced Server SP3 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server Microsoft Outlook 2003 0 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP3 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Internet Explorer 5.0.1 SP4 - Microsoft Windows 2000 Advanced Server SP4 - Microsoft Windows 2000 Datacenter Server SP4 - Microsoft Windows 2000 Professional SP4 - Microsoft Windows 2000 Server SP4 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I Avaya S8100 Media Servers R9 Avaya S8100 Media Servers R8 Avaya S8100 Media Servers R7 Avaya S8100 Media Servers R6 Avaya S8100 Media Servers R12 Avaya S8100 Media Servers R11 Avaya S8100 Media Servers R10 Avaya S8100 Media Servers 0 + Microsoft Windows 2000 Server + Microsoft Windows NT Server 4.0 SP6a Avaya Modular Messaging (MAS) 3.0 Avaya Modular Messaging (MAS)
Not Vulnerable:

Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability

Microsoft Internet Explorer is prone to a buffer-overflow vulnerability that arises because of an error in the processing of Vector Markup Language documents.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. The method currently used to exploit this issue will typically terminate Internet Explorer.

This vulnerability is currently being exploited in the wild as 'Trojan.Vimalov'.

This vulnerability affects Internet Explorer version 6.0 on a fully patched system. Previous versions may also be affected.

Update: Microsoft Outlook 2003 is also an attack vector for this issue, since it uses Internet Explorer to render HTML email. Reportedly, attacks are possible even when active scripting has been disabled for email viewing.

Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability

Proprietary, non-public, proof-of-concept exploits are currently available for this vulnerability.

Exploits for members of the Immunity Partner's Program are available.

UPDATE (May 15, 2007): This issue is being exploited by the MPack hacker tool. Please see the references for more information.

The following exploits are available:

• /data/vulnerabilities/exploits/20096.html
• /data/vulnerabilities/exploits/vml.c
• /data/vulnerabilities/exploits/20096.pl
• /data/vulnerabilities/exploits/20096_jamikazu.txt
• /data/vulnerabilities/exploits/20096_XP_SP0_SP1_2K.pl
• /data/vulnerabilities/exploits/ie_vml_rectfill.pm
• /data/vulnerabilities/exploits/ms06_055_vml_method.rb

Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability

Solution:
Microsoft has released advisory MS06-055 to address this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

Note: A third-party, temporary fix is available from the Zeroday Emergency Response Team (ZERT). Symantec has not verified this fix; Microsoft does not support it. Please see the references for more information.


Microsoft Windows Server 2003 Datacenter Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Windows XP Service Pack 2 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=B5F19858-4E86 -4FD4-A264-E4823FF6D0A9&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=271E9C78-1C6A -443E-924D-43FD6D51E643&displaylang=en

Microsoft Windows XP Tablet PC Edition SP1

• Microsoft Security Update for Internet Explorer 6 Service Pack 1 for Windows XP Service Pack 1 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=383C13DC-51A9 -4B12-89E3-871A1A3DE98F&displaylang=en

Microsoft Windows XP Media Center Edition SP1

• Microsoft Security Update for Internet Explorer 6 Service Pack 1 for Windows XP Service Pack 1 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=383C13DC-51A9 -4B12-89E3-871A1A3DE98F&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=271E9C78-1C6A -443E-924D-43FD6D51E643&displaylang=en

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Internet Explorer 6.0 SP1

• Microsoft Security Update for Internet Explorer 6 Service Pack 1 for Windows 2000 Service Pack 4 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=EA7DE30F-D765 -4E5B-BFD4-64F3FED578FF&displaylang=en

Microsoft Windows Server 2003 Standard Edition

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=E2CB474F-FC1B -4B7D-A607-02A1528C6743&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=271E9C78-1C6A -443E-924D-43FD6D51E643&displaylang=en

Microsoft Windows Server 2003 Datacenter x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=E2CB474F-FC1B -4B7D-A607-02A1528C6743&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Windows Server 2003 Enterprise Edition

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Windows XP Home SP2

• Microsoft Security Update for Windows XP Service Pack 2 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=B5F19858-4E86 -4FD4-A264-E4823FF6D0A9&displaylang=en

Microsoft Windows Server 2003 Web Edition

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Windows XP Home SP1

• Microsoft Security Update for Internet Explorer 6 Service Pack 1 for Windows XP Service Pack 1 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=383C13DC-51A9 -4B12-89E3-871A1A3DE98F&displaylang=en

Microsoft Windows XP Professional x64 Edition

• Microsoft Security Update for Windows XP x64 Edition (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AFD3279C-6171 -4F20-A36E-B9B56EE4C7F1&displaylang=en

Microsoft Windows Server 2003 Web Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=AF8F3A58-BA7A -41BF-BB1B-3A9DDFDC3E27&displaylang=en

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-based Systems (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=271E9C78-1C6A -443E-924D-43FD6D51E643&displaylang=en

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Windows XP Service Pack 2 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=B5F19858-4E86 -4FD4-A264-E4823FF6D0A9&displaylang=en

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for Windows Server 2003 x64 Edition (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=E2CB474F-FC1B -4B7D-A607-02A1528C6743&displaylang=en

Microsoft Windows XP Professional SP1

• Microsoft Security Update for Internet Explorer 6 Service Pack 1 for Windows XP Service Pack 1 (KB925486)
  http://www.microsoft.com/downloads/details.aspx?familyid=383C13DC-51A9 -4B12-89E3-871A1A3DE98F&displaylang=en

Microsoft Internet Explorer Vector Markup Language Buffer Overflow Vulnerability

References:

• Heap Spraying: Exploiting Internet Explorer VML 0-day XP SP2 (Niega)
  
• [1st NEWS] Analysis of CVE-2006-4868 and Patch Description (ZERT)
  
• Analysis of CVE-2006-4668 and Patch Description (ZERT)
  
• Disabling Javascript no longer a valid mitigation for VML exploit (Eric Sites)
  
• Internet Explorer Homepage (Microsoft)
  
• Internet Explorer VML Zero-Day Mitigation (Matthew Murphy)
  
• Microsoft Security Advisory (925568) - Vulnerability in Vector Markup Language C (Microsoft)
  
• Microsoft Security Bulletin MS06-055 - Vulnerability in Vector Markup Language C (Microsoft)
  
• More options on protecting against recent IE vulnerabilities on a domain (Jesper)
  
• MPack Uncovered (pdf document) (PandaLabs)
  
• New Internet Explorer Zero-Day being utilized. (Websense)
  
• Released Patches Page (ZERT)
  
• SALVO - Stack Overflow in IE 6.x VML. This code will crash IE, and an exploit is (Immunity)
  
• SALVO - Working exploit for stack overflow in IE VML (Immunity)
  
• Seen in the wild: Zero Day exploit being used to infect PCs (Eric Sites)
  
• The VML Flaw Harms Outlook 2003 As Well (Portalit)
  
• Trojan.Vimalov (Symantec Corp.)
  
• Vulnerability Note VU#416092 - Microsoft Internet Explorer VML stack buffer over (US-CERT)
  
• Windows VML Vulnerability FAQ (CVE-2006-4868 (Juha-Matti)
  
• Yet Another Internet Explorer Zero Day (eEye)
  
• Zero-Day Response Team Launches with Emergency IE Patch (eWeek)
  
• Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] (Susan Bradley)
  
• Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] ("Bojan Zdrnja" )
  
• Technical Paper on the ZERT Patch and VML [was: Re: ZERT patch for setSlice()] (Gadi Evron )
  
• Avaya security advisory ASA-2006-238 (Avaya)