A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to compromise a vulnerable system. This issue is caused by a user-after-free error in the Internet Explorer Peer Objects module "iepeers.dll" when processing certain data, which could be exploited by remote attackers to execute arbitrary code by tricking a user into visiting a specially crafted web page.

VUPEN confirmed the vulnerability with Internet Explorer 7 on a fully patched Microsoft Windows XP SP3 system.

Note: This vulnerability is being exploited in targeted attacks.

Affected Products

Microsoft Internet Explorer 6.x
Microsoft Internet Explorer 7.x

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft Windows Vista
Microsoft Windows Vista Service Pack 1
Microsoft Windows Vista Service Pack 2
Microsoft Windows Vista x64 Edition
Microsoft Windows Vista x64 Edition Service Pack 1
Microsoft Windows Vista x64 Edition Service Pack 2
Microsoft Windows Server 2008 (32-bit)
Microsoft Windows Server 2008 (32-bit) Service Pack 2
Microsoft Windows Server 2008 (x64)
Microsoft Windows Server 2008 (x64) Service Pack 2
Microsoft Windows Server 2008 (Itanium)
Microsoft Windows Server 2008 (Itanium) Service Pack 2

Solution

Apply patch :
http://www.microsoft.com/technet/security/bulletin/ms10-018.mspx

References

http://www.vupen.com/english/advisories/2010/0567
http://www.microsoft.com/technet/security/bulletin/ms10-018.mspx
http://www.microsoft.com/technet/security/advisory/981374.mspx
http://www.metasploit.com/redmine/projects/framework/repository/revisions/8770

In-depth Binary Analysis

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Public Exploit or PoC

Available in customer area as part of VUPEN Vulnerability Notification Service.
 

Credits

Vulnerability reported by the vendor.

Changelog

2010-03-09 : Initial release
2010-03-09 : Updated Description
2010-03-30 : Updated Solution

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.