Signature Detail

HTTP: Content Advisor Ratings File 'Name' Parameter Overflow (2)

This signature detects attempts to exploit a known vulnerability against Internet Explorer due to the way it handles Content Advisor files from an Apache server. An attacker can exploit the vulnerability by constructing a maliciously crafted Content Advisor file. This malicious Content Advisor file could potentially allow remote code execution if a user visited a malicious Web site or viewed a malicious e-mail message and accepted the installation of the file. A successful attack could take complete control of an affected system. However, significant user interaction is required to exploit this vulnerability.

Extended Description

Microsoft Internet Explorer is prone to a remote buffer overflow vulnerability when handling malformed Content Advisor files. An attacker can exploit this issue by crafting a Content Advisor file with excessive data and arbitrary machine code to be processed by the browser. A typical attack would involve the attacker creating a Web site that includes the malicious file. A similar attack can also be carried out through HTML email using Microsoft Outlook and Microsoft Outlook Express applications. It should be noted that successful exploitation requires the user to follow various steps to install a malicious file.

Affected Products

• Microsoft Internet Explorer 5.0.1
• Microsoft Internet Explorer 5.0.1 SP1
• Microsoft Internet Explorer 5.0.1 SP2
• Microsoft Internet Explorer 5.0.1 SP3
• Microsoft Internet Explorer 5.0.1 SP4
• Microsoft Internet Explorer 5.5
• Microsoft Internet Explorer 5.5 SP1
• Microsoft Internet Explorer 5.5 SP2
• Microsoft Internet Explorer 6.0
• Microsoft Internet Explorer 6.0 SP1

References

• BugTraq: 13117
• CVE: CVE-2005-0555
• URL: http://www.microsoft.com/technet/Security/bulletin/ms05-020.mspx
• URL: http://www.kb.cert.org/vuls/id/222050