[security-alerts] FW: [SA23677] Microsoft Windows Vector Markup Language Buffer Overflow

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ----------------------------------------------------------------------
> 
> TITLE:
> Microsoft Windows Vector Markup Language Buffer Overflow
> 
> SECUNIA ADVISORY ID:
> SA23677
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/23677/
> 
> CRITICAL:
> Extremely critical
> 
> IMPACT:
> System access
> 
> WHERE:
> From remote
> 
> OPERATING SYSTEM:
> Microsoft Windows XP Professional
> http://secunia.com/product/22/
> Microsoft Windows XP Home Edition
> http://secunia.com/product/16/
> Microsoft Windows Server 2003 Web Edition
> http://secunia.com/product/1176/
> Microsoft Windows Server 2003 Standard Edition
> http://secunia.com/product/1173/
> Microsoft Windows Server 2003 Enterprise Edition
> http://secunia.com/product/1174/
> Microsoft Windows Server 2003 Datacenter Edition
> http://secunia.com/product/1175/
> Microsoft Windows 2000 Server
> http://secunia.com/product/20/
> Microsoft Windows 2000 Professional
> http://secunia.com/product/1/
> Microsoft Windows 2000 Datacenter Server
> http://secunia.com/product/1177/
> Microsoft Windows 2000 Advanced Server
> http://secunia.com/product/21/
> 
> SOFTWARE:
> Microsoft Internet Explorer 7.x
> http://secunia.com/product/12366/
> Microsoft Internet Explorer 6.x
> http://secunia.com/product/11/
> Microsoft Internet Explorer 5.01
> http://secunia.com/product/9/
> 
> DESCRIPTION:
> A vulnerability has been reported in Microsoft Windows, which can be
> exploited by malicious people to compromise a user's system
> 
> The vulnerability is caused due to an integer overflow error in the
> Vector Markup Language (VML) implementation and can be exploited to
> cause a heap-based buffer overflow via e.g. a specially crafted web
> page or HTML e-mail.
> 
> Successful exploitation allows execution of arbitrary code.
> 
> NOTE: According to Microsoft, the vulnerability is being actively
> exploited.
> 
> SOLUTION:
> Apply patches.
> 
> Windows XP SP2:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=81FB6
> A72-AC8A-4B28-905F-A44691D69432
> 
> Windows XP Professional x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=D06FD
> 167-4F3E-4A2C-B52C-7426DDAD6828
> 
> Windows Server 2003 (optionally with SP1):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=4FEE4
> 81F-DACE-4EAC-9AFE-BC28ADD70CC5
> 
> Windows Server 2003 for Itanium-based systems (optionally with SP1):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=C517F
> B85-128E-43DB-A659-38AF32283716
> 
> Windows Server 2003 x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=FF4A1
> F24-C1E9-4223-965B-14C4793AAF96
> 
> Internet Explorer 5.01 SP4 on Windows 2000 SP4:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=B1C7F
> 765-772C-4EEB-9438-BC820CB929E1
> 
> Internet Explorer 6 SP1 on Windows 2000 SP4:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=922A3
> 569-85D1-4584-9B84-4AA7304C69BB
> 
> Internet Explorer 7 on Windows XP SP2:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=55A0A
> 6EC-FEFA-40BB-BB6B-3AAB50275A73
> 
> Internet Explorer 7 on Windows XP Pro x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=B5A8B
> 1F2-6AF0-4F03-989C-C8DE2EACE71D
> 
> Internet Explorer 7 on Windows Server 2003 (optionally with SP1):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=08E5C
> D2E-55C0-4AC9-859F-1B24497B31CE
> 
> Internet Explorer 7 on Windows Server 2003 for Itanium-based systems
> (optionally with SP1):
> http://www.microsoft.com/downloads/details.aspx?FamilyId=48B4D
> 271-D494-4A5C-ABA8-11B3B4584902
> 
> Internet Explorer 7 on Windows Server 2003 x64 Edition:
> http://www.microsoft.com/downloads/details.aspx?FamilyId=F9C3E
> 0DE-DB66-4D83-829F-C93052BDB1FA
> 
> PROVIDED AND/OR DISCOVERED BY:
> Jospeh Moti
> 
> ORIGINAL ADVISORY:
> MS07-004 (KB929969):
> http://www.microsoft.com/technet/security/Bulletin/MS07-004.mspx
> 
> iDefense Labs:
> http://labs.idefense.com/intelligence/vulnerabilities/display.
> php?id=462
>