Microsoft Internet Explorer Null Byte Handling Information Disclosure Vulnerability

Bugtraq ID:	51932
Class:	Design Error
CVE:	CVE-2012-0012
Remote:	Yes
Local:	No
Published:	Feb 14 2012 12:00AM
Updated:	Feb 15 2012 05:30PM
Credit:	Jason Hullinger of HP Cloud Services
Vulnerable:	Microsoft Internet Explorer 9 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Microsoft Internet Explorer Null Byte Handling Information Disclosure Vulnerability

Microsoft Internet Explorer is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to view content from the Internet Explorer's process memory. This may allow the attacker to obtain sensitive information or aid in further attacks.

Microsoft Internet Explorer Null Byte Handling Information Disclosure Vulnerability

An attacker can exploit this issue by enticing an unsuspecting to view and interact with a malicious webpage.

Microsoft Internet Explorer Null Byte Handling Information Disclosure Vulnerability

Solution:
Updates are available; please see the references for details.


Microsoft Internet Explorer 9

• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows 7 (KB2647516)
  http://www.microsoft.com/downloads/details.aspx?familyid=c83a9c74-a5a7 -4b3e-ba36-7a7024d99fd8


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows 7 x64 Edition (KB2647516)
  http://www.microsoft.com/downloads/details.aspx?familyid=bbc9d6ae-9ec5 -401f-bf16-4811b63709d1


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 (KB2647516)
  http://www.microsoft.com/downloads/details.aspx?familyid=025a5af0-39f1 -481c-920c-43d2b3d85dc5


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 R2 x64 Edition (KB2647516)
  http://www.microsoft.com/downloads/details.aspx?familyid=1896a6da-f7ee -484b-a97c-455fce7b82b8


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 x64 Edition (KB2647516)
  http://www.microsoft.com/downloads/details.aspx?familyid=c216e01d-2f46 -4a46-bdc7-9d0fe98193a3


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Vista (KB2647516)
  http://www.microsoft.com/downloads/details.aspx?familyid=d287496a-411c -4c1b-9d98-bacc553041ae


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Vista x64 Edition (KB2647516)
  http://www.microsoft.com/downloads/details.aspx?familyid=22cc0245-1877 -4c76-914f-dd68f6cd45f0

Microsoft Internet Explorer Null Byte Handling Information Disclosure Vulnerability

References:

• Internet Explorer Homepage (Microsoft)
  
• ASA-2012-072 MS12-010 Cumulative Security Update for Internet Explorer (2647516) (Avaya)
  
• Microsoft Security Bulletin MS12-010 (Microsoft)