Microsoft Internet Explorer contains a flaw that may allow a malicious user to execute arbitrary commands. The issue is triggered due to a memory corruption error when processing a specially crafted "createTextRange()" call associated with a "checkbox" object. It is possible that the flaw may allow attackers to remotely take complete control of an affected system resulting in a loss of integrity.

Upgrade to version 7.0 Beta 2 Preview that was released on March 20, 2006 or higher, as it has been reported to fix this vulnerability. It is also possible to mitigate the flaw by implementing the following workaround:
Disable Active Scripting support in the Internet security zone.
Note: Disabling Active Scripting may cause some Web sites to work incorrectly.

• Security Tracker: 1015812
• Milw0rm: 1606 1620 1628
• Exploit Database: 1606 1620 1628
• Bugtraq ID: 17196
• Secunia Advisory ID: 18680 18957
• CVE ID: 2006-1359 (see also: NVD)
• SCIP VulDB ID: 2102
• Metasploit ID: 24050
• CERT VU: 876678
• Microsoft Knowledge Base Article: 912812 http://support.microsoft.com/kb/917077
• VUPEN Advisory: ADV-2006-1050
• Mail List Post: http://archives.neohapsis.com/archives/dailydave/2006-q1/0256.html
  http://archives.neohapsis.com/archives/dailydave/2006-q1/0257.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1427.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1430.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1434.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1454.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1654.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1662.html
• News Article: http://blogs.technet.com/msrc/archive/2006/03/22/422849.aspx
  http://www.theregister.co.uk/2006/03/28/eeye_ie_workaround/
• Other Advisory URL: http://secunia.com/secunia_research/2006-7/advisory/
  http://www.computerterrorism.com/research/ct22-03-2006
  http://www.viruslist.com/en/viruses/encyclopedia?virusid=116346
  http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=33953
• Other Solution URL: http://snort.org/rules/advisories/ie-issue-js-v2.txt
• Vendor Specific Advisory URL: http://www.microsoft.com/technet/security/advisory/917077.mspx
• Vendor Specific Solution URL: http://www.microsoft.com/windows/ie/ie7/default.mspx
  http://www.microsoft.com/windows/ie/ie7/ie7betaredirect.mspx
• Generic Exploit URL: http://www.saintcorporation.com/cgi-bin/exploit_info/ie_createtextrange
• Keyword: Microsoft Security Advisory 917077
• Microsoft Security Bulletin: MS06-013
• CIAC Advisory: q-154

• Andreas Sandblad - Secunia Research