Multiple vulnerabilities have been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to gain knowledge of sensitive information or compromise a vulnerable system.

The first issue is caused due to a use-after-free error in the "mshtml.dll" library. For additional information, see : VUPEN/ADV-2010-0135

The second vulnerability is caused due to the browser disabling an HTML attribute in otherwise appropriately filtered response data, which could be exploited to execute script in the context of the logged-on user in a different Internet domain.

The third vulnerability is caused by an input validation error when processing URLs, which could allow a malicious web site to execute a binary from the local client system.

The fourth issue is caused by a memory corruption error when the browser accesses certain objects, which could be exploited by remote attackers to execute arbitrary code.

The fifth vulnerability is caused by a memory corruption error when the browser accesses certain objects, which could be exploited by remote attackers to execute arbitrary code.

The sixth issue is caused by a memory corruption error when the browser accesses certain objects, which could be exploited by remote attackers to execute arbitrary code.

The seventh vulnerability is caused by a memory corruption error when the browser accesses certain objects, which could be exploited by remote attackers to execute arbitrary code.

The eighth vulnerability is caused due to a memory corruption error when the browser attempts to access incorrectly initialized memory, which could be exploited by remote attackers to execute arbitrary code.

Affected Products

Microsoft Internet Explorer 5.x
Microsoft Internet Explorer 6.x
Microsoft Internet Explorer 7.x
Microsoft Internet Explorer 8.x

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Vista x64 Edition Service Pack 2
Microsoft Windows Vista x64 Edition Service Pack 1
Microsoft Windows Vista x64 Edition
Microsoft Windows Vista Service Pack 2
Microsoft Windows Vista Service Pack 1
Microsoft Windows Vista
Microsoft Windows Server 2008 R2 (x64)
Microsoft Windows Server 2008 R2 (Itanium)
Microsoft Windows Server 2008 (x64) Service Pack 2
Microsoft Windows Server 2008 (x64)
Microsoft Windows Server 2008 (Itanium) Service Pack 2
Microsoft Windows Server 2008 (Itanium)
Microsoft Windows Server 2008 (32-bit) Service Pack 2
Microsoft Windows Server 2008 (32-bit)
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows 7 (x64)
Microsoft Windows 7 (32-bit)

Solution

Apply patches :
http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx

References

http://www.vupen.com/english/advisories/2010/0187
http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx
http://www.metasploit.com/redmine/search/index/framework?q=aurora

In-depth Binary Analysis

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Public Exploit or PoC

Available in customer area as part of VUPEN Vulnerability Notification Service.
 

Credits

Vulnerabilities reported by David Lindsay (thornmaker) and Eduardo A. Vela Nava (sirdarckcat), Lostmon Lords, Brett Moore via ZDI, Wushi (team509) via ZDI, Sam Thomas (eshu.co.uk) via ZDI, Haifei Li (Fortinet FortiGuard Global Security Research Team), Peter Vreugdenhil via Verisign iDefense Labs and ZDI, and Meron Sellem (BugSec).

Changelog

2010-01-21 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.