Info

Disclosure

Sep 21, 2012

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Sep 21, 2012

Description

A memory corruption flaw exists in Microsoft Internet Explorer. The program fails to sanitize user-supplied input related to the cloneNode element, resulting in memory corruption. With a specially crafted webpage, a context-dependent attacker can execute arbitrary code.

Classification

Location: Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Private
Disclosure: Vendor Verified, Coordinated Disclosure
OSVDB: Web Related

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.

Products

Microsoft Corporation	Internet Explorer	6
		7
		8

References

Security Tracker: 1027555
CVE ID: 2012-2557 (see also: NVD)
Microsoft Knowledge Base Article: 2744842
Bugtraq ID: 55647
Related OSVDB ID: 85571 85572 85573
Packet Storm: http://packetstormsecurity.org/files/119030/Zero-Day-Initiative-Advisory-12-198.html
Mail List Post: http://seclists.org/fulldisclosure/2012/Dec/214
Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-12-198
Microsoft Security Bulletin: MS12-063

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/85574

Info

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

Microsoft Corporation

Internet Explorer

References

Credit