A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to compromise a vulnerable system. This issue is caused by a use-after-free error in the Microsoft HTML Viewer library "mshtml.dll" when processing certain JavaScript event objects, which could allow attackers to execute arbitrary code by tricking a user into visiting a specially crafted web page.

VUPEN confirmed the vulnerability on fully patched Windows XP SP3 and Windows 7 systems with Internet Explorer 8.

Note: This vulnerability is currently being exploited in the wild.

Affected Products

Microsoft Internet Explorer 6.x
Microsoft Internet Explorer 7.x
Microsoft Internet Explorer 8.x

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Vista x64 Edition Service Pack 2
Microsoft Windows Vista x64 Edition Service Pack 1
Microsoft Windows Vista x64 Edition
Microsoft Windows Vista Service Pack 2
Microsoft Windows Vista Service Pack 1
Microsoft Windows Vista
Microsoft Windows Server 2008 R2 (x64)
Microsoft Windows Server 2008 R2 (Itanium)
Microsoft Windows Server 2008 (x64) Service Pack 2
Microsoft Windows Server 2008 (x64)
Microsoft Windows Server 2008 (Itanium) Service Pack 2
Microsoft Windows Server 2008 (Itanium)
Microsoft Windows Server 2008 (32-bit) Service Pack 2
Microsoft Windows Server 2008 (32-bit)
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows 7 (x64)
Microsoft Windows 7 (32-bit)

Solution

Apply patch :
http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx

References

http://www.vupen.com/english/advisories/2010/0135
http://www.microsoft.com/technet/security/advisory/979352.mspx
http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx
http://www.metasploit.com/redmine/search/index/framework?q=aurora

In-depth Binary Analysis

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Public Exploit or PoC

Available in customer area as part of VUPEN Vulnerability Notification Service.
 

Changelog

2010-01-15 : Initial release
2010-01-21 : Updated Solution

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.