Microsoft Internet Explorer Install Engine contains a buffer overflow vulnerability

Overview

The Active Setup Install Engine in Microsoft Internet Explorer contains a buffer overflow vulnerability. This may allow an attacker to take complete control of a vulnerable system.

Description

The Active Setup Install Engine (inseng.dll) permits cabinet files to be launched and executed. Cabinet files are archives used to store the various files used by ActiveX controls. The Install Engine, which decompresses these cab files, contains a buffer overflow vulnerability. An attacker could exploit this vulnerability by convincing a user to install an ActiveX control that is contained in a specially crafted cabinet file.

---

Impact

An attacker could execute arbitrary code with the privileges of the user logged on to the target machine. If the user is logged on with administrative privileges, the attacker could take complete control of an affected system.

---

Solution

Apply a patch

Apply the patch referenced in MS04-038.

---

Disable Active scripting and ActiveX

Disabling Active scripting and ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this vulnerability. Disabling Active scripting and ActiveX controls in the Local Machine Zone will prevent widely used payload delivery techniques from functioning. Instructions for disabling Active scripting in the Internet Zone can be found in the Malicious Web Scripts FAQ. See Microsoft Knowledge Base Article 833633 for information about securing the Local Machine Zone. Also, Service Pack 2 for Windows XP (currently in beta release) includes these and other security enhancements for IE.

Apply the Outlook Email Security Update

Another way to effectively disable Active scripting in Outlook is to install the Outlook Email Security Update. The update configures Outlook to open email messages in the Restricted Sites Zone, where Active scripting is disabled by default. In addition, the update provides further protection against malicious code that attempts to propagate via Outlook. The Outlook Email Security Update is available for Outlook 98 and Outlook 2000. The functionality of the Outlook Email Security Update is included in Outlook 2002 and Outlook Express 6. Outlook 2003 includes these and other security enhancements.

Read and send email in plain text format

Outlook 2003, Outlook 2002 SP1, and Outlook 6 SP1 can be configured to view email messages in text format. Consider the security of fellow Internet users and send email in plain text format when possible. Note that reading and sending email in plain text will not necessarily prevent exploitation of this vulnerability.

Maintain updated anti-virus software

Anti-virus software with updated virus definitions may identify and prevent some exploit attempts. Variations of exploits or attack vectors may not be detected. Do not rely solely on anti-virus software to defend against this vulnerability. US-CERT maintains a partial list of anti-virus vendors.

Do not follow unsolicited links

Do not click on unsolicited URLs received in email, instant messages, web forums, or internet relay chat (IRC) channels. While this is generally good security practice, following this behavior will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.

---

Vendor Information

637760

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: October 13, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.microsoft.com/technet/security/bulletin/ms04-038.mspx&gt;

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23637760 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/MS04-038.mspx&gt;
• <http://secunia.com/advisories/12806/&gt;

Acknowledgements

The Microsoft Security Bulletin credits Greg Jones and Peter Winter-Smith for reporting this vulnerability.

This document was written by Will Dormann, based on the information provided in the Microsoft Security Bulletin.

Other Information

CVE IDs:	CVE-2004-0216
Severity Metric:	18.81 Date Public: