|
|
Info |
Last Modified |
| about 1 year ago |
|
|
|
|
|
Description |
A heap buffer overflow exists in Microsoft Internet Explorer. The browser's vml rendering engine fails to check the length of a unspecified buffer. With a specially crafted request that contains vml graphics, an attacker can cause arbitrary code execution resulting in a loss of integrity.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
|
|
Technical |
Microsoft Internet Explorer is only vulnerable under Microsoft Windows 2000 or XP. The browser is not vulnerable under Vista.
This vulnerability exists due to insufficient input validation within
vgx.dll. Two integer properties are multiplied together and no overflow
check is performed. This could allow an attacker to force a memory
allocation of a smaller amount of memory than is required. When copying
user supplied data into the newly allocated memory, it is possible to
overwrite a function pointer stored on the heap, which leads to the
execution of arbitrary code.
|
|
Solution |
Microsoft has released a patch to address this issue. Additionally, it is possible to correct the flaw by implementing the following workaround(s):
Unregister the vgx.dll.
|
|
Products |
|
Internet Explorer
 |
5 |
6 |
7 |
|
|
|
|
|
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
