Bugtraqmailing list archives
VUPEN Security Research - Microsoft Internet Explorer "OnPropertyChange_Src()" Use-after-free Vulnerability (CVE-2010-2556)
From: "VUPEN Security Research" <advisories () vupen com>
Date: Wed, 11 Aug 2010 02:54:54 +0200
VUPEN Security Research - Microsoft Internet Explorer"OnPropertyChange_Src()" Use-after-free Vulnerability (CVE-2010-2556)
http://www.vupen.com/english/research.phpI. BACKGROUND---------------------"Microsoft Internet Explorer is a web browser developed by Microsoft andincludedas part of the Microsoft Windows line of operating systems with more than60% of
the worldwide usage share of web browsers." (Wikipedia)II. DESCRIPTION---------------------VUPEN Vulnerability Research Team discovered a critical vulnerabilityaffecting Microsoft Internet Explorer.The vulnerability is caused by a use-after-free error within the"OnPropertyChange_Src()" function when handling malformed HTML/JS data,which could be exploited by remote attackers to execute arbitrary codeby tricking a user into visiting a specially crafted web page.III. AFFECTED PRODUCTS---------------------------Microsoft Internet Explorer 8.xMicrosoft Internet Explorer 7.xMicrosoft Internet Explorer 6.xOn Windows 7, Windows 2008, Windows Vista, Windows 2003 and Windows XP.IV. Binary Analysis & Exploits/PoCs---------------------------------------In-depth binary analysis of the vulnerability and a code execution exploitare available through the VUPEN Binary Analysis & Exploits Service :http://www.vupen.com/english/services/ba-index.phpV. VUPEN Threat Protection Program-----------------------------------Governments and Intelligence agencies who are members of the VUPEN ThreatProtection Program (TPP) have been alerted about the vulnerability when itwas discovered by VUPEN, and have received a detailed detection guidanceto proactively protect national and critical infrastructures againstpotential attacks exploiting this vulnerability:http://www.vupen.com/english/services/tpp-index.phpVI. SOLUTION----------------Apply MS10-053 security update.VII. CREDIT--------------This vulnerability was discovered by Nicolas Joly of VUPEN SecurityVIII. ABOUT VUPEN Security---------------------------VUPEN is a leading IT security research company providing vulnerabilitymanagement and security intelligence solutions which enable enterprisesand institutions to eliminate vulnerabilities before they can be exploited,ensure security policy compliance and meaningfully measure and manage risks.Governmental and federal agencies, and global enterprises in the financialservices, insurance, manufacturing and technology industries rely on VUPENto improve their security, prioritize resources, cut time and costs, andstay ahead of the latest threats.* VUPEN Vulnerability Notification Service (VNS) :http://www.vupen.com/english/services/vns-index.php* VUPEN Binary Analysis & Exploits Service (BAE) :http://www.vupen.com/english/services/ba-index.php* VUPEN Threat Protection Program for Govs (TPP) :http://www.vupen.com/english/services/tpp-index.php* VUPEN Web Application Security Scanner (WASS) :http://www.vupen.com/english/services/wass-index.phpIX. REFERENCES----------------------http://www.vupen.com/english/advisories/2010/2050http://www.microsoft.com/technet/security/bulletin/ms10-053.mspxhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2556X. DISCLOSURE TIMELINE-----------------------------2010-04-13 - Vendor and TPP customers notified2010-04-13 - Vendor response2010-08-06 - Status update received2010-08-10 - Coordinated public Disclosure
Current thread:
- VUPEN Security Research - Microsoft Internet Explorer "OnPropertyChange_Src()" Use-after-free Vulnerability (CVE-2010-2556)VUPEN Security Research (Aug 11)