A memory corruption flaw exists in Windows. WinHTTP.dll fails to properly parse the HTTP chunksize parameter resulting in an integer underflow. With a specially crafted HTTP response, a context-dependent attacker can cause arbitrary code execution, resulting in a loss of integrity.
Classification
Location:
Remote / Network Access
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Patch / RCS
Disclosure:
Vendor Verified
OSVDB:
Web Related
Solution
Microsoft has released a patch to address this vulnerability. Additionally, a user can make registry changes to mitigate this vulnerability without patching.
