68987 : Microsoft IE mshtml CSS Tag Use-after-free Memory Corruption
Printer | http://osvdb.org/68987 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
23	1530	about 1 year ago	8 months ago	21 times	100%

Timeline

Disclosure Date	Exploit Publish Date
2010-11-03	2010-11-04

Keywords

Eleonore exploit kit

Description

Microsoft IE contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to an invalid flag reference within Internet Explorer. It can allow remote code execution

Classification

Location: Local / Remote, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Solution Unknown
Exploit: Exploit Public, Exploit Commercial
Disclosure: Discovered in the Wild

Solution

OSVDB is not aware of a solution for this vulnerability. The usggested workaround are to override the Web site CSS with a user-defined style sheet and enable Data Execution Prevention (DEP) for Internet Explorer 7

Products

Microsoft Corporation	Internet Explorer	7
		6
		8

References

Exploit Database: 15418 15421
CVE ID: 2010-3962 (see also: NVD)
Secunia Advisory ID: 42091
SCIP VulDB ID: 4212
Bugtraq ID: 44536
Metasploit ID: 68987
Vendor Specific News/Changelog Entry: http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx
Vendor Specific Advisory URL: http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx
http://blogs.technet.com/b/srd/archive/2010/11/03/dep-emet-protect-against-attacks-on-the-latest-internet-explorer-vulnerability.aspx
http://www.microsoft.com/technet/security/advisory/2458511.mspx
News Article: http://extraexploit.blogspot.com/2010/11/cve-2010-3962-yet-another-internet.html
http://www.theregister.co.uk/2010/11/03/ie_0day_bug/
http://www.theregister.co.uk/2010/11/11/amnesty_international_hosts_ie_exploit/
Other Advisory URL: http://thompson.blog.avg.com/2010/11/heads-up-0-day-in-an-exploit-kit.html
http://www.itbusinessedge.com/cm/blogs/mah/another-internet-explorer-zero-day-surfaces-added-to-exploit-kit/?cs=44275
http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks
http://www.vupen.com/english/advisories/2010/2880
Generic Exploit URL: http://www.saintcorporation.com/cgi-bin/exploit_info/ie_css_clip
http://www.youtube.com/watch?v=Wgpa7iFKgKo

Manual Testing Notes

Credit

Symantec

CVSSv2 Score

CVSSv2 Base Score = 9.3
Source: nvd.nist.gov | Generated: 2010-11-08 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

2010/12/15 05:28:00 | Microsoft patches critical Internet Explorer and Stuxnet vulnerabilities with heavy load on Patch Tuesday

from: SC Magazine

...of businesses worldwide, whilst the MS10-090 addresses the Internet Explorer ‘Uninitialized Memory Corruption Vulnerability - CVE-2010-3962' which left users exposed to ‘drive-by' hacks and was surprisingly neglected in last month's patch cycle.” Joshua Talbot,...

2010/11/09 22:12:06 | Microsoft Office Takes Center Stage for Patch Tuesday

from: Albequerque Express

...was omitted," Craig Schmugar, research architect at McAfee Labs. "Exploits targeting the recent Internet Explorer zero-day (CVE-2010-3962) have been spotted in Eleonore, also known as Exploit-Eleono, a popular exploit attack kit." nCircle's Reguly agrees....

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.