Technical Description

A critical vulnerability was identified in Microsoft Internet Explorer, which could be exploited by remote attackers to execute arbitrary commands. This issue is due to a memory corruption error when instantiating the "Msdds.dll" (Microsoft Design Tools Diagram Surface) object as an ActiveX control, which could be exploited by an attacker to take complete control of an affected system via a specially crafted Web page.

Note : The affected library is installed with Microsoft Office and Microsoft Visual Studio. Only systems where the "Msdds.dll" library is installed are vulnerable.

This vulnerability has been confirmed on Windows XP SP2 with Internet Explorer 6 and msdds.dll version 7.0.9064.9112.



Affected Products

Microsoft Office XP SP3
Microsoft Access 2002 SP3
Microsoft Visual Studio 2002

Msdds.dll version 7.0.9064.9112
Msdds.dll version 7.0.9064.9143
Msdds.dll version 7.0.9446.0

Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4
Internet Explorer 6 Service Pack 1 on Microsoft Windows XP Service Pack 1
Internet Explorer 6 for Microsoft Windows XP Service Pack 2
Internet Explorer 6 Service Pack 1 for Microsoft Windows XP 64-Bit Edition Service Pack 1 (Itanium)
Internet Explorer 6 for Microsoft Windows Server 2003
Internet Explorer 6 for Microsoft Windows Server 2003 Service Pack 1
Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems
Internet Explorer 6 for Microsoft Windows Server 2003 with SP1 for Itanium-based Systems
Internet Explorer 6 for Microsoft Windows XP 64-Bit Edition Version 2003 (Itanium)
Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition
Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition

Solution

Apply patches :
http://www.microsoft.com/technet/security/Bulletin/MS05-052.mspx

References

http://www.vupen.com/english/advisories/2005/1450
http://www.frsirt.com/exploits/20050817.IE-Msddsdll-0day.php
http://www.microsoft.com/technet/security/advisory/906267.mspx
http://www.microsoft.com/technet/security/Bulletin/MS05-052.mspx
http://www.frsirt.com/english/advisories/2005/2049

Credits

Vulnerability reported by an anonymous person

ChangeLog

2005-08-17 : Initial release
2005-08-17 : Updated affected products (Microsoft Visual Studio)
2005-08-18 : Updated affected products (Microsoft Office)
2005-08-18 : Microsoft Security Advisory (906267)
2005-08-19 : Updated affected products
2005-08-25 : Updated affected products (Msdds.dll 7.0.9064.9143)
2005-10-10 : Updated Solution (MS05-052)

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.