(Vendor Issues Revised Fix) Microsoft Internet Explorer Error in 'mshtml.dll' in Processing GIF Files Lets Remote Users Crash the Browser
|
|
SecurityTracker Alert ID: 1010828
|
|
SecurityTracker URL: http://securitytracker.com/id?1010828
|
|
CVE Reference: CAN-2003-1048
(Links to External Site)
|
Updated: Aug 1 2004
|
Original Entry Date: Jul 30 2004
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 5.01, 5.5, 6
|
Description: A vulnerability was reported in Microsoft Internet Explorer in 'mshtml.dll' in the processing of GIF files. A remote user can cause the target user's browser to crash.
In September 2003, Marc Ruef reported that a specially crafted GIF file can cause Internet Explorer to crash.
Microsoft reports
that the flaw is due to a buffer overflow. A remote user can cause arbitrary code to be executed on the target system. The code
will run with the privileges of the user running Internet Explorer.
|
Impact: A remote user can create a GIF file that, when loaded, will cause the target user's browser to crash or execute arbitrary code with the privileges of the target user.
|
Solution: On July 30, 2004, Microsoft issued fixes as part of a cumulative update (MS04-025). The applicable URLs are listed below.
On
August 1, 2004, Microsoft re-issued security bulletin MS04-025 to warn Windows XP customers using Windows Update version 5 that
they need to reapply the fix because the original Windows Update version 5 files did not contain the proper fixes. To verify if
you are using Windows Update version 5, Microsoft indicates that you can look for the 'Express Install' arrow on the Windows Update
home page and if you see the 'Express Install' arrow on the home page, then you have version 5 installed. If you are affected and
are using the automatic update feature, the new fixes will be applied automatically, the advisory said. If you are affected and
are using the manual update feature, then you need to reapply the update.
The following fixes are available.
Internet Explorer
5.01 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=507E71EF-076B-43C4-8028-E91FCFAB252B&displaylang=en
Internet
Explorer 5.01 Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AA6F31D-7350-43F8-B72E-ED9D62577A60&displaylang=en
Internet
Explorer 5.01 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=862E6914-821A-4C51-985B-C3958FAD3D4C&displaylang=en
Internet
Explorer 5.5 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E458480C-93F6-454A-A663-FC187C18CD9B&displaylang=en
Internet
Explorer 6:
http://www.microsoft.com/downloads/details.aspx?FamilyId=4C2F8A40-1B88-4F93-98B1-1619DCFD7273&displaylang=en
Internet
Explorer 6 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=06F49985-F19F-4B50-A75F-7636D8BEE576&displaylang=en
Internet
Explorer 6 Service Pack 1 (64-Bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=FCDA580D-9E3B-4B44-BD65-C8D37A0DD62D&displaylang=en
Internet
Explorer 6 for Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D86262D9-C66A-4608-8DBE-2492B4AFBC3B&displaylang=en
Internet
Explorer 6 for Windows Server 2003 (64-Bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=1AA8F5A9-71D3-48F7-BB32-F8A4D36C5FB9&displaylang=en
Mi
crosoft reports that IE 6 SP1 and IE 6 for Windows Server 2003 are not affected by this vulnerability.
Microsoft notes that this
update does not include "hotfixes" for Internet Explorer provided since the release of MS04-004. If you have received hotfixes,
see the vendor's advisory for more information:
http://www.microsoft.com/technet/security/bulletin/ms04-025.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms04-025.mspx (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 30 Jul 2004 14:14:17 -0400
Subject: http://www.microsoft.com/technet/security/bulletin/ms04-025.mspx
|
http://www.microsoft.com/technet/security/bulletin/ms04-025.mspx
> Microsoft Security Bulletin MS04-025
> Cumulative Security Update for Internet Explorer (867801)
> Impact of Vulnerability: Remote Code Execution
> Maximum Severity Rating: Critical
> Security Update Replacement: This update replaces the one that is provided in Microsoft
> Security Bulletin MS04-004, which is itself a cumulative update.
Navigation Method Cross-Domain Vulnerability - CAN-2004-0549
Malformed BMP File Buffer Overrun Vulnerability - CAN-2004-0566
Malformed GIF File Double Free Vulnerability - CAN-2003-1048
Microsoft has issued the following fixes:
Internet Explorer 5.01 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=507E71EF-076B-43C4-8028-E91FCFAB252B&dis
playlang=en
Internet Explorer 5.01 Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AA6F31D-7350-43F8-B72E-ED9D62577A60&dis
playlang=en
Internet Explorer 5.01 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=862E6914-821A-4C51-985B-C3958FAD3D4C&dis
playlang=en
Internet Explorer 5.5 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E458480C-93F6-454A-A663-FC187C18CD9B&dis
playlang=en
Internet Explorer 6:
http://www.microsoft.com/downloads/details.aspx?FamilyId=4C2F8A40-1B88-4F93-98B1-1619DCFD7273&dis
playlang=en
Internet Explorer 6 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=06F49985-F19F-4B50-A75F-7636D8BEE576&dis
playlang=en
Internet Explorer 6 Service Pack 1 (64-Bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=FCDA580D-9E3B-4B44-BD65-C8D37A0DD62D&dis
playlang=en
Internet Explorer 6 for Windows Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D86262D9-C66A-4608-8DBE-2492B4AFBC3B&dis
playlang=en
Internet Explorer 6 for Windows Server 2003 (64-Bit Edition):
http://www.microsoft.com/downloads/details.aspx?FamilyId=1AA8F5A9-71D3-48F7-BB32-F8A4D36C5FB9&dis
playlang=en
|
|
