Technical Description

Multiple vulnerabilities have been identified in Microsoft Windows and Internet Explorer, which could be exploited by remote attackers to gain knowledge of sensitive information or compromise a vulnerable system.

The first issue is caused due to the browser incorrectly interpreting the origin of scripts when setting the Window location object, which could allow an attacker to gain access to a browser window in another domain or Internet Explorer zone, leading to arbitrary code execution. For additional information, see : VUPEN/ADV-2008-1940

The second vulnerability is caused due to the browser incorrectly interpreting the origin of scripts when handling certain HTML elements, which could be exploited to execute arbitrary code or conduct cross-domain scripting attacks.

The third issue is caused due to the browser incorrectly interpreting the origin of scripts when handling certain events, which could allow an attacker to gain access to a browser window in another domain or Internet Explorer zone, leading to arbitrary code execution.

The fourth vulnerability is caused due to the browser incorrectly interpreting the origin of scripts, which could allow attackers to read cookies or other data from another security zone or domain.

The fifth issue is caused by a memory corruption error when the browser attempts to access an object which has not been initialized or has been deleted, which could be exploited by attackers to execute arbitrary code.

The sixth vulnerability is caused by a memory corruption error when the brwoser attempts to access uninitialized memory while processing certain HTML objects, which could be exploited by attackers to execute arbitrary code via a malicious web page.

Affected Products

Microsoft Internet Explorer 5.01
Microsoft Internet Explorer 6 Service Pack 1
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 Service Pack 1
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Server 2003 x64 Edition
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP1 (Itanium)
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft Windows Vista
Microsoft Windows Vista Service Pack 1
Windows Vista x64 Edition
Microsoft Windows Vista x64 Edition Service Pack 1
Microsoft Windows Server 2008 (32-bit)
Microsoft Windows Server 2008 (x64)
Microsoft Windows Server 2008 (Itanium)

Solution

Apply patches :
http://www.microsoft.com/technet/security/Bulletin/MS08-058.mspx

References

http://www.vupen.com/english/advisories/2008/2809
http://www.microsoft.com/technet/security/Bulletin/MS08-058.mspx

Credits

Vulnerabilities reported by David Bloom, Gregory Rubin, Ivan Fratric, ZDI, Thierry Zoller (n.runs) and Lee Dagon (Composica).

ChangeLog

2008-10-14 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.