Microsoft Internet Explorer CSS Tags Uninitialized Memory Remote Code Execution Vulnerability

Bugtraq ID:	44536
Class:	Boundary Condition Error
CVE:	CVE-2010-3962
Remote:	Yes
Local:	No
Published:	Nov 03 2010 12:00AM
Updated:	Dec 16 2010 06:54PM
Credit:	Discovered in the wild by Symantec and Jose Antonio Vazquez Gonzalez of VeriSign iDefense Labs.
Vulnerable:	Microsoft Internet Explorer 8 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 SP2 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya Communication Server 1000 Telephony Manager 0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya CallPilot 0 Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Microsoft Internet Explorer CSS Tags Uninitialized Memory Remote Code Execution Vulnerability

Microsoft Internet Explorer is prone to a remote code-execution vulnerability.

Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions.

Microsoft Internet Explorer CSS Tags Uninitialized Memory Remote Code Execution Vulnerability

This issue is actively being exploited in the wild in targeted attacks.

The following exploits are available:

• /data/vulnerabilities/exploits/44536.html
• /data/vulnerabilities/exploits/44536.rb

Microsoft Internet Explorer CSS Tags Uninitialized Memory Remote Code Execution Vulnerability

Solution:
The vendor released an update. Please see the references for details.


Microsoft Internet Explorer 8

• Microsoft Windows6.1-KB2416400-ia64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=c26de145-94b8 -404a-b946-744988fab83b


• Microsoft IE8-WindowsServer2003-KB2416400-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=4f5a3677-0990 -4702-bf08-af64cf12cb6c


• Microsoft IE8-Windows6.0-KB2416400-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=bebf0df0-5ebe -44b4-9ace-b3085a993e58


• Microsoft Windows6.1-KB2416400-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=2cf4ac70-88b4 -4840-9895-2bcf119312a7


• Microsoft Windows6.1-KB2416400-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=c288fe87-b113 -4615-9b02-5e388bcb5241


• Microsoft IE8-WindowsXP-KB2416400-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=a55b8029-9499 -4219-99b7-65c30b0b864a


• Microsoft IE8-WindowsServer2003.WindowsXP-KB2416400-x64-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=d5207bf5-7e58 -4001-aa8f-f9a4b2c037d8


• Microsoft IE8-Windows6.0-KB2416400-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=837b6056-af04 -4aed-8afe-cc392770a590

Microsoft Internet Explorer CSS Tags Uninitialized Memory Remote Code Execution Vulnerability

References:

• DEP, EMET protect against attacks on the latest Internet Explorer vulnerability (Microsoft)
  
• Microsoft Internet Explorer Homepage (Microsoft)
  
• Microsoft Releases Security Advisory 2458511 (Microsoft)
  
• ASA-2010-348 MS10-090 Cumulative Security Update for Internet Explorer (2416400) (Avaya)
  
• Microsoft Internet Explorer CSS Style Table Layout Uninitialized Memory Vulnerab (VeriSign iDefense Labs)
  
• Microsoft Security Advisory (2458511) (Microsoft)
  
• Microsoft Security Bulletin MS10-090 (Microsoft)
  
• New IE Zero-Day used in Targeted Attacks (Symantec)