Signature Detail

HTTP: Microsoft Internet Explorer Deleted Object Memory Corruption

This signature detects attempts to exploit a known vulnerability in Microsoft Explorer. An attacker can create a malicious Web site with Web pages containing reference to deleted objects, which if accessed by a victim, allows the attacker to gain control of the victim's client browser.

Extended Description

Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability that affects a 'timeChildren' object from the HTML+TIME web standard. Attackers can exploit this issue to execute arbitrary code in the context of the user running the browser. Successful exploits will compromise the browser and possibly the computer. Failed attacks may cause denial-of-service conditions.

Affected Products

• Microsoft internet_explorer 6.0
• Microsoft internet_explorer 6.0 SP1
• Microsoft internet_explorer 7.0
• Microsoft internet_explorer 8
• Nortel_networks callpilot 1002Rp
• Nortel_networks callpilot 1005R
• Nortel_networks callpilot 201I
• Nortel_networks callpilot 202I
• Nortel_networks callpilot 600R
• Nortel_networks callpilot 703T
• Nortel_networks contact_center_administration_ccma 6.0
• Nortel_networks contact_center_administration_ccma 7.0
• Nortel_networks contact_center_express
• Nortel_networks contact_center_multimedia
• Nortel_networks contact_center_multimedia_&_outbound 6.0
• Nortel_networks contact_center_multimedia_&_outbound 7.0
• Nortel_networks contact_center_ncc
• Nortel_networks multimedia_comm_mas
• Nortel_networks self-service_mps_100
• Nortel_networks self-service_mps_1000
• Nortel_networks self-service_mps_500
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_peri_workstation
• Nortel_networks self-service_speech_server

References

• BugTraq: 35831
• CVE: CVE-2009-1917