Microsoft Internet Explorer contains a flaw in the way it handles certain "Object" tags. The flaw is triggered due to a buffer overflow in the "Type" property of the "Object" tag. While there are some sanity checks for buffer input, these can be circumvented using special characters. This attack may be utilized wherever IE parses HTML, so this vulnerability, affects newsgroups, mailing lists, or websites.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

• CVE ID: 2003-0344 (see also: NVD)
• Metasploit ID: 2967
• Milw0rm: 37
• Exploit Database: 37
• Bugtraq ID: 7806
• Generic Informational URL: http://lists.netsys.com/pipermail/full-disclosure/2003-July/011079.html
  http://www.eeye.com/html/Research/Advisories/AD20030604.html [ Link is 404 ]
• Vendor Specific Solution URL: http://microsoft.com/windows/ie/downloads/critical/ie6sp1/default.asp
  http://www.microsoft.com/windows/ie/support/ie55exsupport.asp
  http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/default.asp
• Generic Exploit URL: http://msgs.securepoint.com/cgi-bin/get/bugtraq0306/78.html
• Other Advisory URL: http://research.eeye.com/html/advisories/published/AD20030604.html
• Microsoft Security Bulletin: MS03-020

• Drew Copley - eEye Digital Security