Signature Detail

HTTP: Microsoft Internet Explorer CSS Import Use-After-Free Code Execution

This signature detects attempts to exploit a known un-patched code execution vulnerability in Microsoft's Internet Explorer. It is due to the way mshtml.dll handles CSS files with multiple import statements. An attacker can exploit this by enticing a user to open a specially crafted CSS file. A successful attack can lead to a use-after-free condition, which can allow the attacker to execute arbitrary code in the security context of the Internet Explorer.

Extended Description

Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet Explorer versions 6, 7, and 8 are vulnerable.

Affected Products

• Avaya aura_conferencing 6.0 SP1 Standard
• Avaya aura_conferencing 6.0 Standard
• Avaya callpilot 4.0
• Avaya callpilot 5.0
• Avaya communication_server_1000_telephony_manager 3.0
• Avaya communication_server_1000_telephony_manager 4.0
• Avaya meeting_exchange 5.0
• Avaya meeting_exchange 5.0.0.0.52
• Avaya meeting_exchange 5.0 SP1
• Avaya meeting_exchange 5.0 SP2
• Avaya meeting_exchange 5.1
• Avaya meeting_exchange 5.1 SP1
• Avaya meeting_exchange 5.2
• Avaya meeting_exchange 5.2 SP1
• Avaya meeting_exchange 5.2 SP2
• Avaya meeting_exchange-client_registration_server
• Avaya meeting_exchange-recording_server
• Avaya meeting_exchange-streaming_server
• Avaya meeting_exchange-web_conferencing_server
• Avaya meeting_exchange-webportal
• Avaya messaging_application_server 5
• Avaya messaging_application_server 5.2
• Microsoft internet_explorer 6.0
• Microsoft internet_explorer 6.0 SP1
• Microsoft internet_explorer 6.0 SP2
• Microsoft internet_explorer 7.0
• Microsoft internet_explorer 8

References

• BugTraq: 45246
• CVE: CVE-2010-3971