Info

Disclosure

Feb 13, 2007

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Feb 13, 2007

Description

A remote memory corruption flaw exists in Internet Explorer. The flaw is triggered when Msb1fren.dll is instantiated as an ActiveX control within Internet Explorer. With a specially crafted web page, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Unknown
Disclosure: OSVDB Verified, Vendor Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

Products

Microsoft Corporation	Internet Explorer	5
		6
		7

References

Security Tracker: 1017643
CVE ID: 2007-0219 (see also: NVD)
Bugtraq ID: 22504
Secunia Advisory ID: 24156
Related OSVDB ID: 31891 31892 31894 31895
ISS X-Force ID: 32427
CERT VU: 771788
Microsoft Knowledge Base Article: 928090
VUPEN Advisory: ADV-2007-0584
Vendor URL: http://www.microsoft.com
Vendor Specific Advisory URL: http://www.microsoft.com/technet/security/Bulletin/MS07-016.mspx
Microsoft Security Bulletin: MS07-016

Credit

H D Moore - hdmmetasploit.com - DigitalOffense

Direct URL: http://osvdb.org/31893

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

Microsoft Corporation

Internet Explorer

References

Credit