Signature Detail

HTTP: Microsoft Internet Explorer CSS Import Use-After-Free Code Execution

This signature detects attempts to exploit a known un-patched code execution vulnerability in Microsoft's Internet Explorer. It is due to the way mshtml.dll handles CSS files with multiple import statements. An attacker can exploit this by enticing a user to open a specially crafted CSS file. A successful attack can lead to a use-after-free condition, which can allow the attacker to execute arbitrary code in the security context of the Internet Explorer.

Extended Description

Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions. Internet Explorer versions 6, 7, and 8 are vulnerable.

Affected Products

• Avaya Aura Conferencing 6.0 SP1 Standard
• Avaya Aura Conferencing 6.0 Standard
• Avaya CallPilot 4.0
• Avaya CallPilot 5.0
• Avaya Communication Server 1000 Telephony Manager 3.0
• Avaya Communication Server 1000 Telephony Manager 4.0
• Avaya Meeting Exchange 5.0
• Avaya Meeting Exchange 5.0.0.0.52
• Avaya Meeting Exchange 5.0 SP1
• Avaya Meeting Exchange 5.0 SP2
• Avaya Meeting Exchange 5.1
• Avaya Meeting Exchange 5.1 SP1
• Avaya Meeting Exchange 5.2
• Avaya Meeting Exchange 5.2 SP1
• Avaya Meeting Exchange 5.2 SP2
• Avaya Meeting Exchange - Client Registration Server
• Avaya Meeting Exchange - Recording Server
• Avaya Meeting Exchange - Streaming Server
• Avaya Meeting Exchange - Web Conferencing Server
• Avaya Meeting Exchange - Webportal
• Avaya Messaging Application Server 5
• Avaya Messaging Application Server 5.2
• Microsoft Internet Explorer 6.0
• Microsoft Internet Explorer 6.0 SP1
• Microsoft Internet Explorer 6.0 SP2
• Microsoft Internet Explorer 7.0
• Microsoft Internet Explorer 8

References

• BugTraq: 45246
• CVE: CVE-2010-3971