HTTP: Microsoft Internet Explorer selection.empty Use After Free (CVE-2011-1261)

A User-After-Free vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to improper handling of the selection.empty script expression. Remote attackers can exploit this vulnerability by enticing target users to open a malicious web page using Internet Explorer, potentially causing arbitrary code to be injected and executed in the security context of the currently logged on user. In an attack scenario where arbitrary code is injected and executed on the target machine, the behaviour of the target is dependent on the logic of the malicious code. If such an attack is not successful, Internet Explorer may terminate abnormally.

Extended Description

Microsoft Internet Explorer is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to run arbitrary code in the context of the user running the affected application. Failed attacks will cause denial-of-service conditions.

Affected Products

Avaya messaging_application_server,Avaya meeting_exchange

References

BugTraq: 48210

CVE: CVE-2011-1261

Short Name

HTTP:STC:IE:SELECT-EMPTY

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Microsoft Internet Explorer selection.empty Use After Free (CVE-2011-1261)

Extended Description

Affected Products

References

Found a potential security threat?