myITforum.com

Welcome to myITforum.com Sign in | Join | Help
in Search

Harry Waldron - My IT Forums Blog

Sharing Security Developments, and Best Practices for corporate and home users

New Internet Explorer Security Issue - create text range vulnerability

  A newly discovered Internet Explorer security issue has surfaced, but so far there are no known exploits.  Everyone should be careful with email links or websites with any browser. 

New Internet Explorer Security Issue - create text range vulnerability
http://secunia.com/advisories/18680/
http://www.incidents.org/diary.php?storyid=1209

Rating: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched 
Software: Microsoft Internet Explorer 6.x, 7 preview

 
Description:  Secunia Research has discovered a vulnerability in Microsoft Internet Explorer, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an error in the processing of the "createTextRange()" method call applied on a radio button control. This can be exploited by e.g. a malicious web site to corrupt memory in a way, which allows the program flow to be redirected to the heap.

Successful exploitation allows execution of arbitrary code. The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2. The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview. Other versions may also be affected.

Solution: Do not visit untrusted web sites.

Comments

No Comments
Powered by Community Server (Commercial Edition), by Telligent Systems