Signature Detail

HTTP: Microsoft Internet Explorer Vector Markup Language VGX Buffer Overflow

This signature detects attempts to exploit a known flaw in Microsoft Internet Explorer. A buffer overflow vulnerability exists in the Vector Markup Language (VML) implementation in Microsoft Windows. The vulnerability is caused due to an integer underflow in the VML implementation (vgx.dll) when receiving compressed HTTP response. Remote attackers can exploit this vulnerability by enticing the target user to visit a malicious webpage, to cause a heap-based buffer overflow and possibly inject and execute arbitrary code on the target system with the privileges of the currently logged in user. In an attack case where code injection is not successful, the affected application using the vulnerable vgx.dll will terminate abnormally. In a more sophisticated attack where code injection results is successful, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the current user.

Extended Description

Microsoft Internet Explorer is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. This issue occurs when rendering VML (Vector Markup Language) graphics. Attackers can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Successful attacks may facilitate the remote compromise of affected computers. Failed attacks will likely cause denial-of-service conditions.

Affected Products

• Avaya Customer Interaction Express (CIE) User Interface 1.0
• Avaya Customer Interaction Express (CIE) User Interface 1.0.2
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• HP Storage Management Appliance 2.1
• HP Storage Management Appliance I
• HP Storage Management Appliance II
• HP Storage Management Appliance III
• Microsoft Internet Explorer 5.0.1
• Microsoft Internet Explorer 5.0.1 SP1
• Microsoft Internet Explorer 5.0.1 SP2
• Microsoft Internet Explorer 5.0.1 SP3
• Microsoft Internet Explorer 5.0.1 SP4
• Microsoft Internet Explorer 6.0
• Microsoft Internet Explorer 6.0 SP1
• Microsoft Internet Explorer 7.0

References

• BugTraq: 25310
• CVE: CVE-2007-1749