Signature Detail

HTTP: Microsoft Internet Explorer DHTML Objects Memory Corruption

This signature detects attempts to exploit a known memory corruption vulnerability exists in Microsoft Internet Explorer. It is due to the way Internet Explorer handles switching of page location. Remote attackers can exploit this by persuading target users to visit a specially crafted Web page. A successful code injection attack allows the attacker to execute arbitrary code on the client system, in the context of the logged in user. The behavior of the target depends on the intention of the attacker. In an unsuccessful attack, Internet Explorer can terminate abnormally

Extended Description

Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability because it fails to adequately handle user-supplied input to certain DHTML object methods. Attackers can exploit this issue to execute arbitrary code in the context of a user running the application. Successful attacks would compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

Affected Products

• Avaya messaging_application_server MM 1.1
• Avaya messaging_application_server MM 2.0
• Avaya messaging_application_server MM 3.0
• Avaya messaging_application_server MM 3.1
• Avaya messaging_application_server
• Hp storage_management_appliance 2.1
• Hp storage_management_appliance I
• Hp storage_management_appliance II
• Hp storage_management_appliance III
• Microsoft internet_explorer 6.0
• Microsoft internet_explorer 6.0 SP1
• Microsoft internet_explorer 7.0
• Nortel_networks callpilot 1002Rp
• Nortel_networks callpilot 200I
• Nortel_networks callpilot 201I
• Nortel_networks callpilot 702T
• Nortel_networks callpilot 703T
• Nortel_networks contact_center_administration
• Nortel_networks contact_center_express
• Nortel_networks contact_center_manager
• Nortel_networks contact_center_manager_server
• Nortel_networks contact_center_multimedia
• Nortel_networks contact_center_ncc
• Nortel_networks enterprise_voip TM-CS1000
• Nortel_networks multimedia_comm MCS5100
• Nortel_networks multimedia_comm MCS5200
• Nortel_networks multiservice_data_manager
• Nortel_networks self-service_mps_100
• Nortel_networks self-service_mps_1000
• Nortel_networks self-service_mps_500
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_peri_workstation
• Nortel_networks self-service_speech_server
• Nortel_networks umts Null
• Nortel_networks w-nms-cnm 1.0
• Nortel_networks w-nms-umts 4.2

References

• BugTraq: 26427
• CVE: CVE-2007-5347