Vulnerability Note VU#136849

Microsoft Internet Explorer UTF-8 decoding vulnerability

Original Release date: 13 Jun 2006 | Last revised: 13 Jun 2006

Overview

Microsoft Internet Explorer fails to properly decode UTF-8 encoded HTML. This may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

Unicode

The Unicode character set contains more than 96,000 characters. Because of this, Unicode can be used to represent a wide range of languages.

UTF-8

UTF-8 (Unicode Tranlation Format 8) is a type of character encoding for Unicode character sets.

The problem

Internet Explorer fails to properly calculate memory sizes when decoding UTF-8 encoded characters. This can cause heap memory corruption.

Impact

By convincing a user to view a specially crafted HTML document (e.g., a web page, an HTML email message, or an email attachment), an attacker could execute arbitrary code with the privileges of the user. The attacker could also cause IE (or the program using the MSHTML component) to crash.

Solution

Apply an update

This issue is addressed in Microsoft Security Bulletin MS06-021. This update modifies the way that Internet Explorer decodes UTF-8 encoded HTML.


Read and send email in plain text format

Outlook 2003, Outlook 2002 SP1, and Outlook 6 SP1 can be configured to view email messages in text format. Consider the security of fellow Internet users and send email in plain text format when possible.

Do not follow unsolicited links

In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected-13 Jun 2006
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Microsoft Security for reporting this vulnerability. Microsoft, in turn, thanks Tippingpoint for reporting this issue.

This document was written by Will Dormann.

Other Information

  • CVE IDs: CVE-2006-2382
  • Date Public: 13 Jun 2006
  • Date First Published: 13 Jun 2006
  • Date Last Updated: 13 Jun 2006
  • Severity Metric: 17.21
  • Document Revision: 2

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.