Microsoft Internet Explorer contains buffer overflow in processing of object types

2003-06-04T00:00:00
ID VU:679556
Type cert
Reporter CERT
Modified 2003-06-04T20:33:00

Description

Overview

A remotely exploitable vulnerability has been discovered in Internet Explorer. Exploitation of this vulnerability may lead to the execution of arbitrary code.

Description

A remotely exploitable buffer overflow vulnerability has been discovered in Internet Explorer versions 5.1, 5.5 and 6.0. The <object> tag contains a "type" field used to determine how Internet Explorer should treat an object. It is possible to bypass the buffer checks on the input to the "type" field by using a specific character and cause a buffer overflow.

An attacker could create an HTML file that includes a malicious <OBJECT> tag to execute arbitrary code on the victim's machine. When a victim using a vulnerable version of IE, or other applications that use IE as their HTML interpreter, visits the malicious file (via web page, email message, file sharing, etc.), the attacker-supplied code will be executed.


Impact

Exploitation of this vulnerability may lead to the execution of arbitrary code with the privileges of the current user.


Solution

Microsoft has released MS03-020 to resolve this issue.


Vendor Information

679556

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Vendor has issued information

__ Sort by: Status Alphabetical

Expand all

Affected Unknown __ Unaffected

Javascript is disabled. Click here to view vendors.

__ Microsoft Corporation

Updated: June 04, 2003

Status

__ Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see <http://www.microsoft.com/security/security_bulletins/ms03-020.asp>.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | | N/A

References

  • <http://www.microsoft.com/windows/ie/downloads/critical/818529/default.asp>
  • <http://www.microsoft.com/security/security_bulletins/ms03-020.asp>
  • <http://www.eeye.com/html/Research/Advisories/AD20030604.html>
  • <http://www.secunia.com/advisories/8943/>

Credit

Thanks to Microsoft Security and eEye Digital Security for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

CVE IDs: | CVE-2003-0344
---|---
Severity Metric:** | 17.47
Date Public:
| 2003-06-04
Date First Published: | 2003-06-04
Date Last Updated: | 2003-06-04 20:33 UTC
Document Revision: | 11