Microsoft Internet Explorer 6/7 CSS Handling Code Execution Vulnerability
Posted by hackthisway on November 26, 2009
“This issue is caused due to a memory corruption error in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the “getElementsByTagName()” method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious web page.”
source: VUPEN
Exploit has been added to metasploit. See a screenshot :
Vulnerable Products :
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft Windows Vista
Microsoft Windows Vista Service Pack 1
Microsoft Windows Vista Service Pack 2
Microsoft Windows Vista x64 Edition
Microsoft Windows Vista x64 Edition Service Pack 1
Microsoft Windows Vista x64 Edition Service Pack 2
Microsoft Windows Server 2008 (32-bit)
Microsoft Windows Server 2008 (32-bit) Service Pack 2
Microsoft Windows Server 2008 (x64)
Microsoft Windows Server 2008 (x64) Service pack 2
Microsoft Windows Server 2008 (Itanium)
Microsoft Windows Server 2008 (Itanium) Service Pack 2
Prevention:
Disable Active Scripting.
Patch:
Not available till date.
If you want to check your browser against CSS vulnerabilities, you may visit :
http://digitaloffense.net/tools/see-ess-ess-die/cssdie.html
Follow the instructions carefully and click on test being sure of the risks.
