HTTP: Internet Explorer VML Fill Overflow

This signature detects attempts to exploit a known vulnerability in Windows Internet Explorer. A malicious Web site can exploit Web pages containing dangerous Vector Markup Language (VML) descriptions that cause buffer overflows. A successful attacker can gain control of the client browser.

Extended Description

Microsoft Internet Explorer is prone to a buffer-overflow vulnerability that arises because of an error in the processing of Vector Markup Language documents. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. The method currently used to exploit this issue will typically terminate Internet Explorer. This vulnerability is currently being exploited in the wild as 'Trojan.Vimalov'. This vulnerability affects Internet Explorer version 6.0 on a fully patched system. Previous versions may also be affected. Update: Microsoft Outlook 2003 is also an attack vector for this issue, since it uses Internet Explorer to render HTML email. Reportedly, attacks are possible even when active scripting has been disabled for email viewing.

Affected Products

Avaya s8100_media_servers,Microsoft windows_xp_media_center_edition

References

BugTraq: 20096

CVE: CVE-2006-4868

URL: http://www.microsoft.com/technet/security/advisory/925568.mspx http://sunbeltblog.blogspot.com/2006/09/seen-in-wild-zero-day-exploit-being.html

Short Name

HTTP:STC:IE:VML-FILL-BOF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Internet Explorer VML Fill Overflow

Extended Description

Affected Products

References

Found a potential security threat?