Vulnerability Note VU#932283

Microsoft Internet Explorer HTML rendering engine contains buffer overflow processing SRC attribute of HTML <EMBED> directive

<EMBED SRC="/path/sound.mid" AUTOSTART="true">

SECURITY.NNOV has reported that the Internet Explorer HTML rendering engine (mshtml.dll) does not properly handle the SRC attribute of the <EMBED> directive. An HTML document, such as a web page or HTML email message, containing a crafted SRC attribute can trigger a buffer overflow, executing code with the privileges of the user running the rendering engine. Microsoft Internet Explorer, Outlook, Outlook Express, compiled HTML help files (.chm), and other email clients and applications that use the Internet Explorer HTML rendering engine may be vulnerable. Note that Internet Explorer for Macintosh and Internet Explorer for Unix are not vulnerable.

This vulnerability is also addressed in CERT Advisory CA-2002-04.

II. Impact

Apply the appropriate patch as referenced in Microsoft Security Advisory MS02-005.

Disable "Run ActiveX Controls and Plugins"

In Internet Explorer, a plugin is used to view, play, or otherwise process embedded documents. The execution of embedded documents is controlled by the "Run ActiveX Controls and Plugins" security option. Disabling this option will prevent embedded documents from being processed, and therefore prevent this vulnerability from being exploited. At a minimum, disable the "Run ActiveX Controls and Plugins" security option in the Internet zone and the zone used by Outlook or Outlook Express. Instructions on how to set the security level for the Internet zone to "High" can be found in the CERT/CC Malicious Web Scripts FAQ. In the "High" security level, the "Run ActiveX Controls and Plugins" security option is disabled.

From MS02-005:

The vulnerability could not be exploited if the "Run ActiveX Controls and Plugins" security option were disabled in the Security Zone in which the page was rendered. This is the default condition in the Restricted Sites Zone, and can be disabled manually in any other Zone.

http://www.cert.org/advisories/CA-2002-04.html
http://www.security.nnov.ru/advisories/mshtml.asp
http://www.microsoft.com/technet/security/bulletin/MS02-005.asp
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q317731
http://www.securityfocus.com/bid/4080
http://www.iss.net/security_center/static/8116.php
http://msdn.microsoft.com/workshop/author/dhtml/reference/objects/embed.asp
http://developer.netscape.com/docs/manuals/htmlguid/tags14.htm#1286379

Credit

The CERT/CC thanks ERRor and DarkZorro of domain Hell and 3APA3A of SECURITY.NNOV for reporting this issue to us.

This document was written by Art Manion and Ian A. Finlay.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.