CERT Advisory MSoft Buffer Overflow

Paul Wilders · Feb 25, 2002

Original release date: February 25, 2002
Last revised: --
Source: CERT/CC

A complete revision history can be found at the end of this file.

Systems Affected
Microsoft Internet Explorer
Microsoft Outlook and Outlook Express
Other applications that use the Internet Explorer HTML rendering engine
Overview
Microsoft Internet Explorer contains a buffer overflow vulnerability in its handling of embedded objects in HTML documents. This vulnerability could allow an attacker to execute arbitrary code on the victim's system when the victim visits a web page or views an HTML email message.

I. Description
Internet Explorer supports the <EMBED> directive, which can be used to include arbitrary objects in HTML documents. Common types of embedded objects include multimedia files, Java applets, and ActiveX controls. The SRC attribute specifies the source path and filename of an object. For example, a MIDI sound might be embedded in a web page with the following HTML code:

<EMBED TYPE="audio/midi" SRC="/path/sound.mid" AUTOSTART="true">
Internet Explorer uses attributes of the <EMBED> directive and MIME information from the web server to determine how to handle an embedded object. In most cases, a separate application or plugin is used.

A group of Russian researchers, SECURITY.NNOV, has reported that Internet Explorer does not properly handle the SRC attribute of the <EMBED> directive. An HTML document, such as a web page or HTML email message, that contains a crafted SRC attribute can trigger a buffer overflow, executing code with the privileges of the user viewing the document.

According to the Severity Rating for the "Buffer Overrun in HTML Directive" vulnerability in MS02-005, Internet Explorer 5.5 and 6.0 are vulnerable. Outlook and Outlook Express are also vulnerable, since they use Internet Explorer to render HTML email messages. Other applications that use the Internet Explorer HTML rendering engine, such as Windows compiled HTML help (.chm) files and third-party email clients, may also be vulnerable.
Click to expand...

Read the full article here:

www.cert.org/advisories/CA-2002-04.html

Tiger_Barb · Feb 25, 2002

Hi,

Nice post Paul, now I guess it's time to start digging deep in my pocket's and go with The Bat and Opera.....

T Barb

Paul Wilders · Feb 25, 2002

Thanks TB

Unless you opt for "SecureBat!" (talking about bucks..) it's not all that expensive, taking into account what you will get into return.

As for Opera: looking forward to the final release. Untill then, I'm quite satisfied with version 5x besides IE.

As it seems, security comes with a price tag on many ocassions. Can't help but blaming Billyware for it

regards.

paul

Tiger_Barb · Feb 25, 2002

Paul,

Can't help but blaming Billyware for it
Click to expand...

God, aint that the truth.....

T Barb

Log in or Sign up

CERT Advisory MSoft Buffer Overflow

Paul Wilders Administrator

Tiger_Barb Registered Member

Paul Wilders Administrator

Tiger_Barb Registered Member

Cert NZ gains access to withheld domain name data

strongSwan VPN charon server vulnerable to buffer underflow

MikroTik RouterOS SMB Buffer Overflow

Lenovo Releases Security Advisory

NCSC Releases Security Advisory

Log in or Sign up

CERT Advisory MSoft Buffer Overflow

Paul Wilders Administrator

Tiger_Barb Registered Member

Paul Wilders Administrator

Tiger_Barb Registered Member

Cert NZ gains access to withheld domain name data

strongSwan VPN charon server vulnerable to buffer underflow

MikroTik RouterOS SMB Buffer Overflow

Lenovo Releases Security Advisory

NCSC Releases Security Advisory

Useful Searches