Openwares.org Internet Explorer Patch Buffer Overflow Vulnerability
BID:9259
Info
Openwares.org Internet Explorer Patch Buffer Overflow Vulnerability
| Bugtraq ID: | 9259 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 19 2003 12:00AM |
| Updated: | Dec 19 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Heise Security. |
| Vulnerable: |
Openwares.org IEpatch |
| Not Vulnerable: | |
Discussion
Openwares.org Internet Explorer Patch Buffer Overflow Vulnerability
It has been reported that the Internet Explorer patch supplied by Openwares.org for the Multiple Browser URI Display Obfuscation Weakness (BID 9182) may be prone to a buffer overflow condition that may allow an attacker to execute arbitrary code on a vulnerable system in order to gain unauthorized access. The condition is present due to insufficient boundary checking. The problem is reported to exist in the BeforeNavigateEvent() function of IETray.cpp module. This may also cause a denial of service condition in Internet Explorer.
It has been reported that the Internet Explorer patch supplied by Openwares.org for the Multiple Browser URI Display Obfuscation Weakness (BID 9182) may be prone to a buffer overflow condition that may allow an attacker to execute arbitrary code on a vulnerable system in order to gain unauthorized access. The condition is present due to insufficient boundary checking. The problem is reported to exist in the BeforeNavigateEvent() function of IETray.cpp module. This may also cause a denial of service condition in Internet Explorer.
Exploit / POC
Openwares.org Internet Explorer Patch Buffer Overflow Vulnerability
A test of this vulnerability has been provided by Heise Security at the following location:
http://www.heise.de/security/dienste/browsercheck/demos/ie/e5_18.shtml
A test of this vulnerability has been provided by Heise Security at the following location:
http://www.heise.de/security/dienste/browsercheck/demos/ie/e5_18.shtml
Solution / Fix
Openwares.org Internet Explorer Patch Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Openwares.org Internet Explorer Patch Buffer Overflow Vulnerability
References:
References:
- Homepage (Openwares.org)
- Open SOURCE developers eliminate errors in the InterNet Explorer (Heise Security)