(Vendor Issues Fix) Microsoft Internet Explorer 'javaprxy.dll' COM Object Exception Handling Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1014459
|
|
SecurityTracker URL: http://securitytracker.com/id?1014459
|
|
CVE Reference: CAN-2005-2087
(Links to External Site)
|
Date: Jul 12 2005
|
Impact: Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Advisory
|
Version(s): 6.0 SP1 and prior versions; Tested on 6.0.2900.2180
|
Description: A vulnerability was reported in Microsoft Internet Explorer in 'javaprxy.dll'. A remote user can cause the target user's browser to crash or execute arbitrary code.
A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a heap overflow in 'javaprxy.dll'
and cause the target user's browser to crash. Specially crafted object tags can cause certain COM componenets to crash.
It is
also possible to overwrite a function pointer to execute arbitrary code.
A demonstration exploit from FrSIRT is available at:
http://www.frsirt.com/exploits/2005070
2.iejavaprxyexploit.pl.php
The vendor was notified on June 17, 2005.
sk0L and Martin Eiszner from SEC-CONSULT discovered this
vulnerability.
|
Impact: A remote user can cause the target user's browser to crash.
A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued the following fixes:
Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details
.aspx?FamilyId=25982E02-EC6D-44CE-82DE-12DDEF1ADDD6
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack
4, or on Microsoft Windows XP Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2A506C16-01EF-4060-BCF8-6993C55840A9
Internet
Explorer 6 for Microsoft Windows XP Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=C1381768-6C6D-4568-97B1-600DB8798EBF
Internet
Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=F368E231-9918-4
881-9F17-60312F82183F
Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for
Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyId=D785F9AB-DBE9-4272-A87E-64205690F98E
Internet
Explorer 6 for Microsoft Windows Server 2003 x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=68209225-A682-4008-A22B-881C401486F7
Internet
Explorer 6 for Microsoft Windows XP Professional x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=80EFD9A8-7EE9-4B0B-8517-559C49614AB7
Slovenia
n:
http://www.microsoft.com/downloads/details.aspx?FamilyId=06F8CD1B-93A0-4522-AF7D-603DD5C2BACB&displaylang=sl
Slovakian:
http://www.microsoft.com/downloads/det
ails.aspx?FamilyId=06F8CD1B-93A0-4522-AF7D-603DD5C2BACB&displaylang=sk
A restart is not required.
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS05-037.mspx (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Windows (Me), Windows (98), Windows (2000), Windows (2003), Windows (XP)
|
Underlying OS Comments: 2000 SP4, XP SP2, 2003 SP1; and prior service packs
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 12 Jul 2005 02:10:43 -0400
Subject: http://www.microsoft.com/technet/security/Bulletin/MS05-037.mspx
|
http://www.microsoft.com/technet/security/Bulletin/MS05-037.mspx
|
|
