From labs-no-reply@idefense.com Tue Apr 12 15:42:25 2005 From: iDEFENSE Labs To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org, full-disclosure@lists.netsys.com Date: Tue, 12 Apr 2005 14:43:36 -0400 Subject: iDEFENSE Security Advisory 04.12.05: Microsoft Windows Internet Explorer Long Hostname Heap Corruption Vulnerability Microsoft Windows Internet Explorer Long Hostname Heap Corruption Vulnerability iDEFENSE Security Advisory 04.12.05 www.idefense.com/application/poi/display?id=229&type=vulnerabilities April 12, 2005 I. BACKGROUND Internet Explorer is a set of core technologies in Microsoft Windows operating systems that provide web browsing functionality. Further information is available at: http://www.microsoft.com/ie/. II. DESCRIPTION Remote exploitation of an input validation error in Microsoft Corp.'s Internet Explorer may allow the execution of arbitrary code. The vulnerability specifically exists in the handling of long hostnames. When IE is requested to open a URL with a hostname part longer than about 256 characters, the heap becomes slightly corrupted. This corruption may cause no visible effect, or it may cause the Address Bar to contain a URL with "garbage" characters as the hostname. It may also cause IE to crash, referencing an invalid memory address. In testing done, the addresses referred during a crash are at times controllable by the web page containing the malformed URL. III. ANALYSIS Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the current user. Although it is not trivial to exploit this vulnerability, it is believed to be possible. Testing during verification of this vulnerability revealed multiple situations where remotely supplied values were used to reference memory locations. A remote attacker may be able to read data from, write data to, or execute arbitrary code by supplying specifically malformed content. IV. DETECTION iDEFENSE Labs has confirmed that Internet Explorer 6.0.2180 on Windows XP with Service Pack 2 is vulnerable. V. WORKAROUND iDEFENSE is currently unaware of any effective workarounds for this issue. The vulnerable functionality is a major part of the affected product, and is it is not possible to disable it. Although it will not prevent all means of exploitation, disable active scripting if it is not necessary for day-to-day operations using the following steps: 1. In IE, click on Tools and select Internet Options from the drop-down menu. 2. Click the Security tab and the Custom Level button. 3. Under Scripting, then Active Scripting, click the Disable radio button. VI. VENDOR RESPONSE This vulnerability is addressed in Microsoft Security Bulletin MS05-020 available at: http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the names CAN-2005-0554 to these issues. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 11/11/2004 Initial vendor notification 11/11/2004 Initial vendor response 04/12/2005 Coordinated public disclosure IX. CREDIT 3APA3A (http://www.security.nnov.ru/) and axle@bytefall are credited with this discovery. Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp Free tools, research and upcoming events http://labs.idefense.com X. LEGAL NOTICES Copyright (c) 2005 iDEFENSE, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.