Microsoft Internet Explorer CSS Tag Parsing Code Execution Vulnerability
Last Update Date:
28 Jan 2011
Release Date:
4 Nov 2010
4566
Views
RISK: Medium Risk
A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to take complete control of a vulnerable system. This issue is caused due to an invalid flag reference within the "mshtml.dll" module when processing a Cascading Style Sheets (CSS) "clip" attribute with a specific position, which could allow remote attackers to crash an affected browser or arbitrary code via a specially crafted web page.
The vulnerability is being exploited in the wild.
Impact
- Remote Code Execution
System / Technologies affected
- Microsoft Windows XP
- Microsoft Windows Server 2003
- Microsoft Windows Vista
- Microsoft Windows Server 2008
- Microsoft Windows 7
- Microsoft Windows Server 2008 R2
- Internet Explorer 6
- Internet Explorer 7
- Internet Explorer 8
Solutions
- It is not aware of any vendor-supplied patch.
- Workaround
- Override the Web site CSS with a user-defined style sheet
( For details, please refer to http://www.microsoft.com/technet/security/advisory/2458511.mspx )
- Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
Vulnerability Identifier
Source
Related Link
Share with