Microsoft Internet Explorer Select HTML Element Use-After-Free Memory Corruption Vulnerability
BID:45260
Info
Microsoft Internet Explorer Select HTML Element Use-After-Free Memory Corruption Vulnerability
| Bugtraq ID: | 45260 |
| Class: | Unknown |
| CVE: |
CVE-2010-3345 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 14 2010 12:00AM |
| Updated: | Dec 21 2010 03:04PM |
| Credit: | Stephen Fewer working with TippingPoint's Zero Day Initiative |
| Vulnerable: |
Microsoft Internet Explorer 8 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya Communication Server 1000 Telephony Manager 0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya CallPilot 0 Avaya Aura Conferencing 6.0 Standard |
| Not Vulnerable: | |
Discussion
Microsoft Internet Explorer Select HTML Element Use-After-Free Memory Corruption Vulnerability
Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.
Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions.
Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.
Successful exploits will allow an attacker to run arbitrary code in the context of the user running the application. Failed attacks will cause denial-of-service conditions.
Exploit / POC
Microsoft Internet Explorer Select HTML Element Use-After-Free Memory Corruption Vulnerability
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Microsoft Internet Explorer Select HTML Element Use-After-Free Memory Corruption Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Microsoft Internet Explorer 8
Solution:
The vendor has released an advisory and updates. Please see the references for details.
Microsoft Internet Explorer 8
-
Microsoft IE8-WindowsServer2003.WindowsXP-KB2416400-x64-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=d5207bf5-7e58 -4001-aa8f-f9a4b2c037d8 -
Microsoft IE8-Windows6.0-KB2416400-x86.msu
http://www.microsoft.com/downloads/details.aspx?familyid=bebf0df0-5ebe -44b4-9ace-b3085a993e58 -
Microsoft IE8-Windows6.0-KB2416400-x64.msu
http://www.microsoft.com/downloads/details.aspx?familyid=837b6056-af04 -4aed-8afe-cc392770a590 -
Microsoft IE8-WindowsServer2003-KB2416400-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=4f5a3677-0990 -4702-bf08-af64cf12cb6c -
Microsoft IE8-WindowsXP-KB2416400-x86-ENU.exe
http://www.microsoft.com/downloads/details.aspx?familyid=a55b8029-9499 -4219-99b7-65c30b0b864a
References
Microsoft Internet Explorer Select HTML Element Use-After-Free Memory Corruption Vulnerability
References:
References: