Overview
» IDS/IPS Signatures
Security Sites
iPolicy Networks Security Advisory
 

Microsoft IE Uninitialized HTML Object Memory Corruption Vulnerability
Date Discovered: 03/31/2010
Severity: High
Operating Systems Affected: Microsoft Windows
Applications Affected: Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 7.0
Microsoft Internet Explorer 8.0
Type: Remote
Identifiers: CVE-2010-0490
Synopsis

Microsoft Internet Explorer is prone to a memory corruption vulnerability, which could be exploited to gain the same user rights as a logged-on user.
Recommended Actions
Update the patches as guided by vendor at :
http://www.microsoft.com/technet/security/Bulletin/MS10-018.mspx
iPolicy Networks Response

iPolicy IPF provides detection of this vulnerability by the following signature:

•Possible_Microsoft_IE_Uninitialized_HTML_Object_Memory_Corruption

This signature is available in IDS pack 10099
Threat Analysis

Microsoft Internet Explorer is a well known proprietary web browser application developed by Microsoft and included as part of the Microsoft Windows line of operating systems. A memory corruption flaw exists in Microsoft Internet Explorer 6, 6 SP1, 7, and 8

The flaw exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. Successful exploitation allows remote attackers to run arbitrary code in the context of the user running the affected application or failed attacks may cause denial-of-service condition leading to crash.
References

http://www.securityfocus.com/bid/39031
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2010-0490
http://www.microsoft.com/technet/security/Bulletin/MS10-018.mspx

Write-up by: Dheeraj Johri