Microsoft Internet Explorer URL Buffer Overflow in Processing HTTP 1.1 Protocol with Compression Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016731
|
|
SecurityTracker URL: http://securitytracker.com/id?1016731
|
|
CVE Reference: CVE-2006-3869
(Links to External Site)
|
Updated: Sep 13 2006
|
Original Entry Date: Aug 22 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 6 SP1 with original MS06-042 patch applied
|
Description: A vulnerability was reported in Microsoft Internet Explorer. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted URL to sites using HTTP 1.1 and compression that, when loaded by the target user, will
trigger a buffer overflow and execute arbitrary code on the target system. The code will run with the privileges of the target
user.
The vulnerability was introduced (or exposed) in the original MS06-042 patch for IE 6 SP1. Only IE 6 SP1 with the original
MS06-042 patch is affected.
|
Impact: A remote user can create a URL that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: On September 12, 2006, Microsoft re-issued the MS06-042 patches because of vulnerabilities in the original set of patches and in
the August 24, 2006 re-release.
The Microsoft advisories are available at:
http://www.microsoft.com/technet/security/advisory/923762.mspx
http://www.microsoft.com/
technet/security/bulletin/ms06-042.mspx
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms06-042.mspx (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (2000), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 22 Aug 2006 17:38:32 -0400
Subject: Internet Explorer 6 Service Pack 1 unexpectedly exits after you install the 918899 update
|
http://support.microsoft.com/?kbid=923762
|
|
