[security-alerts] FW: ZDI-07-027: Microsoft Internet Explorer Table Column Deletion Memory Corruption Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

Еще техническая информация об уязвимостях, устраняемых майскими патчами

> 
> ZDI-07-027: Microsoft Internet Explorer Table Column Deletion Memory
>             Corruption Vulnerability
> http://www.zerodayinitiative.com/advisories/ZDI-07-027.html
> May  8, 2007
> 
> -- CVE ID:
> CVE-2007-0944
> 
> -- Affected Vendor:
> Microsoft
> 
> -- Affected Products:
> Internet Explorer 5
> Internet Explorer 6
> 
> -- TippingPoint(TM) IPS Customer Protection:
> TippingPoint IPS customers have been protected against this
> vulnerability since May  8, 2007 by Digital Vaccine protection
> filter ID 5236. For further product information on the 
> TippingPoint IPS:
> 
>     http://www.tippingpoint.com 
> 
> -- Vulnerability Details:
> This vulnerability allows remote attackers to execute 
> arbitrary code on
> vulnerable installations of Microsoft Internet Explorer. User
> interaction is required to exploit this vulnerability in that the
> target must visit a malicious page.
> 
> The specific flaw exists in the CTableCol::OnPropertyChange() method.
> When a named table row in HTML contains a named table column, then
> calls the deleteCell() JavaScript method, any property of the table
> column, existing or not, accessed after the deletion takes place will
> trigger an exploitable memory corruption.
> 
> -- Vendor Response:
> Microsoft has issued an update to correct this vulnerability. More
> details can be found at:
> 
>     http://www.microsoft.com/technet/security/bulletin/ms07-027.mspx
> 
> -- Disclosure Timeline:
> 2006.10.03 - Vulnerability reported to vendor
> 2007.05.08 - Digital Vaccine released to TippingPoint customers
> 2007.05.08 - Coordinated public release of advisory
> 
> -- Credit:
> This vulnerability was discovered by an anonymous researcher.
> 
> -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, a division of 3Com, The Zero Day 
> Initiative
> (ZDI) represents a best-of-breed model for rewarding security
> researchers for responsibly disclosing discovered vulnerabilities.
> 
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
> 
>     http://www.zerodayinitiative.com
> 
> The ZDI is unique in how the acquired vulnerability 
> information is used.
> 3Com does not re-sell the vulnerability details or any exploit code.
> Instead, upon notifying the affected product vendor, 3Com provides its
> customers with zero day protection through its intrusion prevention
> technology. Explicit details regarding the specifics of the
> vulnerability are not exposed to any parties until an official vendor
> patch is publicly available. Furthermore, with the altruistic aim of
> helping to secure a broader user base, 3Com provides this 
> vulnerability
> information confidentially to security vendors (including competitors)
> who have a vulnerability protection or mitigation product.
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>