Signature Detail

SSL: Microsoft Internet Explorer SChannel Exploit

This signature detects attempts to exploit a known vulnerability in Internet Explorer. Attackers can create malicious Web pages containing a malformed SSL negotiation, which if accessed by a victim, can allow the attacker to gain control of the victim's client browser.

Extended Description

The Microsoft Windows Schannel security package is prone to a remote code-execution vulnerability. This vulnerability occurs when processing and validating server-sent digital signatures by the client application. A remote attacker could exploit this issue by convincing a victim to visit a malicious website. Remote code execution is possible, but may be extremely difficult. In most cases, denial-of-service conditions will occur.

Affected Products

• Avaya Customer Interaction Express (CIE) User Interface 1.0
• Avaya Messaging Application Server MM 1.1
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• Avaya Messaging Application Server
• HP Storage Management Appliance 2.1
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Server SP4
• Microsoft Windows Server 2003 SP1
• Microsoft Windows Server 2003 SP2
• Microsoft Windows Server 2003 Datacenter Edition SP1
• Microsoft Windows Server 2003 Datacenter x64 Edition SP2
• Microsoft Windows Server 2003 Enterprise Edition SP1
• Microsoft Windows Server 2003 Enterprise x64 Edition SP2
• Microsoft Windows Server 2003 Itanium SP1
• Microsoft Windows Server 2003 Itanium SP2
• Microsoft Windows Server 2003 Standard Edition SP1
• Microsoft Windows Server 2003 Standard Edition SP2
• Microsoft Windows Server 2003 Web Edition SP1
• Microsoft Windows Server 2003 Web Edition SP2
• Microsoft Windows Server 2003 x64 SP1
• Microsoft Windows Server 2003 x64 SP2
• Microsoft Windows XP Home SP2
• Microsoft Windows XP Media Center Edition SP2
• Microsoft Windows XP Professional SP2
• Microsoft Windows XP Professional x64 Edition SP2
• Microsoft Windows XP Professional x64 Edition
• Microsoft Windows XP Tablet PC Edition SP2
• Nortel Networks CallPilot 1002Rp
• Nortel Networks CallPilot 200I
• Nortel Networks CallPilot 201I
• Nortel Networks CallPilot 702T
• Nortel Networks CallPilot 703T
• Nortel Networks Centrex IP Client Manager 2.5.0
• Nortel Networks Centrex IP Client Manager 7.0.0
• Nortel Networks Centrex IP Client Manager 8.0.0
• Nortel Networks Centrex IP Client Manager 9.0
• Nortel Networks Contact Center
• Nortel Networks Contact Center Express
• Nortel Networks Contact Center - TAPI Server
• Nortel Networks Enterprise Network Management System
• Nortel Networks Multimedia Comm MCS5100
• Nortel Networks Multiservice Access Switch 4400 Null
• Nortel Networks Self-Service MPS 100
• Nortel Networks Self-Service MPS 1000
• Nortel Networks Self-Service MPS 500
• Nortel Networks Self-Service Peri Application
• Nortel Networks Self-Service Peri Workstation
• Nortel Networks Self-Service Speech Server
• Nortel Networks Self-Service WVADS
• Nortel Networks Symposium Agent
• Nortel Networks Web Centric Self-Svc CCXML
• Nortel Networks Web Centric Self-Svc VoiceXML

References

• BugTraq: 24416
• CVE: CVE-2007-2218