Microsoft Internet Explorer Javaprxy.DLL COM Object Instantiation Heap Overflow Vulnerability

2005-06-29T00:00:00
ID SMNTC-14087
Type symantec
Reporter Symantec Security Response
Modified 2005-06-29T00:00:00

Description

Description

Microsoft Internet Explorer is prone to a heap-based buffer-overflow vulnerability that occurs when the 'javaprxy.dll' COM object is instantiated by a malicious webpage. Attackers may exploit this issue to execute arbitrary code in the context of the client.

Technologies Affected

  • Microsoft Internet Explorer 5.0.1
  • Microsoft Internet Explorer 5.0.1 SP1
  • Microsoft Internet Explorer 5.0.1 SP2
  • Microsoft Internet Explorer 5.0.1 SP3
  • Microsoft Internet Explorer 5.0.1 SP4
  • Microsoft Internet Explorer 5.5
  • Microsoft Internet Explorer 5.5 SP1
  • Microsoft Internet Explorer 5.5 SP2
  • Microsoft Internet Explorer 6.0
  • Microsoft Internet Explorer 6.0 SP1
  • Microsoft Internet Explorer 6.0 SP2 do not use
  • Nortel Networks Centrex IP Client Manager

Recommendations

Run all software as a nonprivileged user with minimal access rights.
To limit the impact of browser vulnerabilities, perform nonadministrative activities as an unprivileged user with minimal access rights.

Do not follow links provided by unknown or untrusted sources.
Users should be wary of visiting sites of questionable integrity, especially if enticed to do so in unsolicited email.

The vendor has released an advisory (903144) that contains workarounds to prevent exploits of this issue. Customers are urged to review the referenced advisory for further information. Microsoft has released security bulletin MS05-037 along with fixes to address this issue. Please see the referenced advisory for more information. Nortel has released bulletin number 2005006061 describing vulnerable packages. Fixes are not currently available. Please see the referenced document for details.