|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
 |
Vulnerability Note VU#744549
Microsoft Internet Explorer iepeers.dll use-after-free vulnerability
OverviewMicrosoft Internet Explorer contains a use-after-free vulnerability in the iepeers.dll file, which may allow a remote, unauthenticated attacker to execute arbitrary code.
I. DescriptionMicrosoft Internet Explorer provides support for Web Folders and printing through the use of the iepeers.dll component. According to Microsoft Security Advisory (981374), the iepeers.dll contains a vulnerability in the use of a pointer after an object is freed. Microsoft reports that the vulnerability, which affects Internet Explorer 6 and 7, has been reported publicly.
Exploit code for this vulnerability is publicly available. This vulnerability is currently being exploited in the wild.
II. ImpactBy convincing a user to load a specially crafted HTML document or Microsoft Office document, a remote, unauthenticated attacker may be able to execute arbitrary code or cause a denial-of-service condition.
III. SolutionApply an update
This issue is addressed in Microsoft Security Bulletin MS10-018, which modifies the way Internet Explorer handles objects in memory.
Enable Data Execution Prevention (DEP) on Internet Explorer 6 or Internet Explorer 7
Microsoft has published more information on DEP as a mitigation for this vulnerability. DEP should not be treated as a complete workaround, but DEP can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. Use of DEP should be considered in conjunction with other mitigations described in this document.
Set the Internet zone security setting to "High"
Setting the Internet zone security setting to "High" will result in the user being prompted before running ActiveX controls and Active Scripting, which may reduce the risk of certain attack vectors.
Disable Active Scripting
Disabling Active Scripting will prevent Active Scripting from running, which may reduce the risk of certain attack vectors.
Systems Affected
References
http://www.microsoft.com/technet/security/bulletin/ms10-018.mspx
http://www.microsoft.com/technet/security/advisory/981374.mspx
http://support.microsoft.com/kb/927917
Credit
Thanks to Microsoft for reporting this vulnerability.
This document was written by Will Dormann.
Other Information
| Date Public: | 2010-03-09 |
| Date First Published: | 2010-03-09 |
| Date Last Updated: | 2010-03-30 |
| CERT Advisory: | |
| CVE-ID(s): | CVE-2010-0806 |
| NVD-ID(s): | CVE-2010-0806 |
| US-CERT Technical Alerts: | |
| Severity Metric: | 28.55 |
| Document Revision: | 16 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
|