Vulnerability Note VU#932283

Microsoft Internet Explorer HTML rendering engine contains buffer overflow processing SRC attribute of HTML <EMBED> directive

Original Release date: 14 Feb 2002 | Last revised: 29 Mar 2002

Overview

The Microsoft Internet Explorer HTML rendering engine contains a vulnerability in its handling of the SRC attribute of the HTML <EMBED> directive. An attacker who is able to convince a user to read a malicious HTML file may be able to crash Internt Explorer or execute arbitrary code with the user's privileges.

Description

Web pages and HTML email messages typically contain HTML text, but may include other documents using the <EMBED> directive. For example, a MIDI sound file might be embedded in a web page with the following HTML code:

<EMBED SRC="/path/sound.mid" AUTOSTART="true">

SECURITY.NNOV has reported that the Internet Explorer HTML rendering engine (mshtml.dll) does not properly handle the SRC attribute of the <EMBED> directive. An HTML document, such as a web page or HTML email message, containing a crafted SRC attribute can trigger a buffer overflow, executing code with the privileges of the user running the rendering engine. Microsoft Internet Explorer, Outlook, Outlook Express, compiled HTML help files (.chm), and other email clients and applications that use the Internet Explorer HTML rendering engine may be vulnerable. Note that Internet Explorer for Macintosh and Internet Explorer for Unix are not vulnerable.

This vulnerability is also addressed in CERT Advisory CA-2002-04.

Impact

By convincing a user to view a malicious HTML document, an attacker could cause the Internet Explorer HTML rendering engine to crash or execute arbitrary code. This technique could be used to distribute viruses, worms, or other malicious code. Any code executed through this vulnerability would run with the privileges of the user who viewed the HTML document.

Solution

Apply Patch
Apply the appropriate patch as referenced in Microsoft Security Advisory MS02-005.


Disable "Run ActiveX Controls and Plugins"

In Internet Explorer, a plugin is used to view, play, or otherwise process embedded documents. The execution of embedded documents is controlled by the "Run ActiveX Controls and Plugins" security option. Disabling this option will prevent embedded documents from being processed, and therefore prevent this vulnerability from being exploited. At a minimum, disable the "Run ActiveX Controls and Plugins" security option in the Internet zone and the zone used by Outlook or Outlook Express. Instructions on how to set the security level for the Internet zone to "High" can be found in the CERT/CC Malicious Web Scripts FAQ. In the "High" security level, the "Run ActiveX Controls and Plugins" security option is disabled.

From MS02-005:

    The vulnerability could not be exploited if the "Run ActiveX Controls and Plugins" security option were disabled in the Security Zone in which the page was rendered. This is the default condition in the Restricted Sites Zone, and can be disabled manually in any other Zone.
Apply Outlook Email Security Update

Outlook 2002 and Outlook Express 6, and Outlook 98 and 2000 with the Outlook Email Security Update applied, open email messages in the Restricted Sites Zone. The "Run ActiveX Controls and Plugins" security option is disabled by default in the Restricted Sites Zone.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
AOL Time WarnerAffected05 Mar 200229 Mar 2002
MicrosoftAffected20 Dec 200105 Mar 2002
CyrusoftNot Affected22 Feb 200225 Feb 2002
LotusUnknown22 Feb 200225 Feb 2002
QUALCOMMUnknown22 Feb 200225 Feb 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT/CC thanks ERRor and DarkZorro of domain Hell and 3APA3A of SECURITY.NNOV for reporting this issue to us.

This document was written by Art Manion and Ian A. Finlay.

Other Information

  • CVE IDs: CAN-2002-0022
  • CERT Advisory: CA-2002-04
  • Date Public: 11 Feb 2002
  • Date First Published: 14 Feb 2002
  • Date Last Updated: 29 Mar 2002
  • Severity Metric: 50.49
  • Document Revision: 109

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.