[CS-FSLUG] Internet Explorer Multiple Vulnerabilities

[Fred Miller]

Internet Explorer Multiple Vulnerabilities

CRITICAL: Extremely critical

IMPACT:
Spoofing, Exposure of sensitive information, System access

WHERE: From remote

SOFTWARE:
Microsoft Internet Explorer 6
http://secunia.com/product/11/
Microsoft Internet Explorer 5.5
http://secunia.com/product/10/
Microsoft Internet Explorer 5.01
http://secunia.com/product/9/

DESCRIPTION:
Multiple vulnerabilities have been reported in Internet Explorer,
where the most critical can be exploited by malicious people to
compromise a user's system.

1) A boundary error within the processing of CSS (Cascading Style
Sheets) can be exploited to cause a buffer overflow via a malicious
web page or HTML e-mail message.

Successful exploitation allows execution of arbitrary code.

2) An error in the cross-domain security model within the handling of
navigation methods by functions with similar names can be exploited to
execute arbitrary script code in the "Local Machine" security zone or
access information in a different domain.

For more information:
SA12048

3) A boundary error in the Install Engine (Inseng.dll) can be
exploited to cause a buffer overflow via a malicious web page or HTML
e-mail message.

Successful exploitation allows execution of arbitrary code.

4) Insufficient validation of drag and drop events issued from the
"Internet" zone to local resources can be exploited by malicious
people to plant arbitrary executable files on a user's system.

For more information:
SA12321

5) A canonicalization error within the processing of URLs on DBCS
(Double Byte Character Set) systems can be exploited to spoof
information displayed in the address bar.

6) An error within the processing of plug-in navigations can be
exploited to spoof information displayed in the address bar.

7) An error within the way scripts are processed in image tags can be
exploited to save files on a user's system by tricking the user into
visiting a malicious web site or view a malicious e-mail message.

For more information:
SA12048

8) An error within the handled of cached SSL content can be exploited
to access sensitive information or spoof content on SSL-protected web
sites.

SOLUTION:
Apply patches.

Internet Explorer 5.01 SP3 on Windows 2000 SP3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2D8E8E97-4946-4994-924B-1FB1DC1881BA&displaylang=en

Internet Explorer 5.01 SP4 on Windows 2000 SP4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=72DBE239-AF0A-42B5-B88C-A00371F6EC81&displaylang=en

Internet Explorer 5.5 SP2 on Microsoft Windows Me:
http://www.microsoft.com/downloads/details.aspx?FamilyId=BE27F77C-3C2D-45F1-86DF-2B71799DA169&displaylang=en
        
Internet Explorer 6 on Windows XP:
http://www.microsoft.com/downloads/details.aspx?FamilyId=A89CFBE8-C299-415D-A9D6-7CC6429C547D&displaylang=en
        
Internet Explorer 6 SP1 on Windows 2000 SP3/SP4, Windows XP, or
Windows XP SP1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7C1404E6-F5D4-4FED-9573-DD83F2DFF074&displaylang=en

Internet Explorer 6 SP1 on Windows NT Server 4.0 SP6a, Windows NT
Server 4.0 TSE SP6, Windows 98 and SE, or Windows Me:
http://www.microsoft.com/downloads/details.aspx?FamilyId=DE8D94C4-7F58-4CE7-B8BD-51CFD795B03E&displaylang=en

Internet Explorer 6 for Windows XP SP1 (64-Bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=C05103E8-4402-4D54-BA03-FBBC24142E4D&displaylang=en

Internet Explorer 6 for Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=19E69E5F-9C98-49AD-A61F-4F82A4014412&displaylang=en

Internet Explorer 6 for Windows Server 2003 64-Bit Edition and
Windows XP 64-Bit Edition Version 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=566C2A05-2513-4E30-A3EA-87D4BF7F9730&displaylang=en

Internet Explorer 6 for Windows XP SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CF47B515-3F51-43E1-9246-2C2264C49E2E&displaylang=en

PROVIDED AND/OR DISCOVERED BY:
3) Greg Jones of KPMG UK and Peter Winter-Smith of Next Generation
Security Software.
8) Mitja Kolsek, ACROS Security.

ORIGINAL ADVISORY:
MS04-038 (KB834707):
http://www.microsoft.com/technet/security/bulletin/ms04-038.mspx

-- 
"Running Windows on a Pentium is like getting a Porsche but only being
able to drive it in reverse with the handbrake on."