Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution Vulnerability

ID SMNTC-13799
Type symantec
Reporter Symantec Security Response
Modified 2005-05-28T00:00:00



Microsoft Internet Explorer is affected by a remote code execution vulnerability. This vulnerability presents itself when the browser handles a JavaScript 'onLoad' handler in conjunction with an improperly initialized 'window()' JavaScript function. This issue may be exploited to execute arbitrary remote code in the context of the user running the affected application. Failed exploitation attempts likely result in the application crashing.

Technologies Affected

  • Avaya DefinityOne Media Servers
  • Avaya DefinityOne Media Servers R10
  • Avaya DefinityOne Media Servers R11
  • Avaya DefinityOne Media Servers R12
  • Avaya DefinityOne Media Servers R6
  • Avaya DefinityOne Media Servers R7
  • Avaya DefinityOne Media Servers R8
  • Avaya DefinityOne Media Servers R9
  • Avaya IP600 Media Servers
  • Avaya IP600 Media Servers R10
  • Avaya IP600 Media Servers R11
  • Avaya IP600 Media Servers R12
  • Avaya IP600 Media Servers R6
  • Avaya IP600 Media Servers R7
  • Avaya IP600 Media Servers R8
  • Avaya IP600 Media Servers R9
  • Avaya Modular Messaging (MAS)
  • Avaya S8100 Media Servers
  • Avaya S8100 Media Servers R10
  • Avaya S8100 Media Servers R11
  • Avaya S8100 Media Servers R12
  • Avaya S8100 Media Servers R6
  • Avaya S8100 Media Servers R7
  • Avaya S8100 Media Servers R8
  • Avaya S8100 Media Servers R9
  • Avaya Unified Communications Center S3400
  • Microsoft Internet Explorer 5.0.1
  • Microsoft Internet Explorer 5.0.1 For Windows 2000
  • Microsoft Internet Explorer 5.0.1 SP1
  • Microsoft Internet Explorer 5.0.1 SP2
  • Microsoft Internet Explorer 5.0.1 SP3
  • Microsoft Internet Explorer 5.0.1 SP4
  • Microsoft Internet Explorer 5.5
  • Microsoft Internet Explorer 5.5 SP1
  • Microsoft Internet Explorer 5.5 SP2
  • Microsoft Internet Explorer 6.0
  • Microsoft Internet Explorer 6.0 SP1


Run all software as a nonprivileged user with minimal access rights.
Execute all software as a user with minimal privileges. Software that may potentially handle malicious content should by insulated with additional precautions such as restrictive environments.

Do not follow links provided by unknown or untrusted sources.
Users should refrain from following links that originate from unknown or questionable sources.

Set web browser security to disable the execution of script code or active content.
It may be possible to prevent successful exploitation by disabling script code and active content support within the client browser. It should be noted that this mitigation tactic might adversely affect legitimate Web sites that rely on the execution of browser based script code.

Implement multiple redundant layers of security.
As it may be possible that this issue will be leveraged to execute code, memory protection schemes are recommended. Memory protection schemes such as non-executable stack/heap configurations and randomly mapped memory segments will complicate exploitation of memory corruption vulnerabilities.

Microsoft has released fixes for supported operating system versions. Fixes for Internet Explorer 5.5 SP 2 running on Windows ME and Internet Explorer 6 SP 1 running on Windows 98/98SE/ME can be obtained through the Microsoft Update Web site or the Windows Update Web site. Avaya has released advisory ASA-2005-234 detailing affected Avaya products. Please see the referenced advisory for further information.