Internet Explorer CSS Tag Parsing Code Execution Vulnerability

Posted on Thursday, November 04, 2010 @ 03:15:46 PDT in Security
by Raven

SECUNIA ADVISORY ID: SA42091

VERIFY ADVISORY: Secunia.com: http://secunia.com/advisories/42091/

Criticality: Highly Critical

DESCRIPTION: A vulnerability has been reported in Internet Explorer, which can be exploited by malicious people to compromise a user's system. Successful exploitation allows execution of arbitrary code. NOTE: The vulnerability is currently being actively exploited.

The vulnerability is caused due to insufficient memory being allocated to store a certain combination of CSS (Cascading Style Sheets) tags. This can be exploited to overwrite a byte in a virtual table pointer and call into user-controlled data in memory via a specially crafted web page.

SOLUTION: Apply a custom CSS to override website CSS styles (please see the Microsoft advisory for details).

PROVIDED AND/OR DISCOVERED BY: Reported as a 0-day.

ORIGINAL ADVISORY: Microsoft:
http://www.microsoft.com/technet/security/advisory/2458511.mspx
http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx
http://blogs.technet.com/b/srd/archive/2010/11/03/dep-emet-protect-against-attacks-on-the-latest-internet-explorer-vulnerability.aspx
 
 
click Related        click Share
 
 
Associated Topics

Internet


Microsoft
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 359,527,782
  • Today: 73,492
Server InfoServer Info
  • Jun 25, 2018
  • 12:34 pm PDT
 
 

Daily Inspiration