Microsoft Internet Explorer Speech API 4 COM Object Instantiation Buffer Overflow Vulnerabilities

2007-06-12T00:00:00
ID SMNTC-24426
Type symantec
Reporter Symantec Security Response
Modified 2007-06-12T00:00:00

Description

Description

Microsoft Internet Explorer is prone to multiple buffer-overflow vulnerabilities when instantiating certain COM objects. An attacker may exploit these issues by enticing victims into opening a maliciously crafted webpage. Successfully exploiting these issues allows remote attackers to execute arbitrary machine code in the context of the affected application, facilitating the remote compromise of affected computers.

Technologies Affected

  • Avaya CIE 1.0
  • Avaya Messaging Application Server
  • Avaya Messaging Application Server MM 2.0
  • Avaya Messaging Application Server MM 3.0
  • Avaya Messaging Application Server MM 3.1
  • HP Storage Management Appliance 2.1
  • HP Storage Management Appliance 2.1
  • Microsoft Internet Explorer 5.0
  • Microsoft Internet Explorer 5.0.1 SP1
  • Microsoft Internet Explorer 5.0.1 SP2
  • Microsoft Internet Explorer 5.0.1 SP3
  • Microsoft Internet Explorer 5.0.1 SP4
  • Microsoft Internet Explorer 5.0.1 SP4
  • Microsoft Internet Explorer 6.0
  • Microsoft Internet Explorer 6.0 SP1
  • Microsoft Internet Explorer 7.0
  • Nortel Networks Centrex IP Client Manager 7.0.0
  • Nortel Networks Centrex IP Client Manager 8.0.0
  • Nortel Networks Centrex IP Client Manager 9.0
  • Nortel Networks Centrex IP Client Manager

Recommendations

Do not follow links provided by unknown or untrusted sources.
Users should be wary of visiting sites of questionable integrity or following links provided by unfamiliar or suspicious sources.

Set web browser security to disable the execution of script code or active content.
Disabling scripting and active content in the Internet Zone may limit exposure to this and other vulnerabilities.

Implement multiple redundant layers of security.
Various memory-protection schemes (such as nonexecutable and randomly mapped memory segments) may hinder an attacker's ability to exploit this vulnerability to execute arbitrary code.

Run all software as a nonprivileged user with minimal access rights.
To limit the impact of latent vulnerabilities, run the web client as an unprivileged user with minimal access rights.

Microsoft has released an advisory along with fixes to address these issues. Please see the references for more information.