- Microsoft Windows
- Microsoft Internet Explorer
Microsoft has released updates that address critical vulnerabilities in Internet Explorer (IE). A remote, unauthenticated attacker could exploit these vulnerabilities to execute arbitrary code or cause a denial of service on an affected system.
The Microsoft Security Bulletins for December 2005 address vulnerabilities in Microsoft Windows and Internet Explorer. By convincing a user to view a specially crafted HTML document, such as a web page or an HTML email message or attachment, an attacker could execute arbitrary code with the privileges of the user. The attacker could also cause IE or the program using the WebBrowser control to crash.
Further information is available in the following US-CERT Vulnerability Notes:
VU#887861 - Microsoft Internet Explorer vulnerable to code execution via mismatched DOM objects
Microsoft Internet Explorer fails to properly handle requests to mismatched DOM objects, which may allow a remote attacker to execute arbitrary code on a vulnerable system.
VU#959049 - Several COM objects cause memory corruption in Microsoft Internet Explorer
Microsoft Internet Explorer allows instantiation of COM objects not designed for use in the browser, which may allow an attacker to execute arbitrary code or crash IE.
A remote, unauthenticated attacker exploiting these vulnerabilities could execute arbitrary code with the privileges of the user. If the user is logged on with administrative privileges, the attacker could take complete control of an affected system or cause a denial of service.
Disable ActiveX to prevent IE from instantiating COM objects. Disabling ActiveX in the Internet Zone will provide increased protection against the vulnerabilities described in VU#959049 and VU#680526. Instructions for disabling ActiveX are available in the CERT/CC Malicious Web Scripts FAQ. Note that disabling ActiveX will reduce the functionality of some web sites. For example, the Microsoft Update site will not work with ActiveX disabled. To enable ActiveX for a web site, add that site to the Trusted Sites Zone. The default settings for the Trusted Sites Zone enable ActiveX.
The updates provided by MS05-037, MS05-038, MS05-052, and MS05-054 set the kill bit for a number of vulnerable COM objects. There may, however, be other vulnerable COM objects that have not yet been identified. To protect against future threats, consider disabling ActiveX in addition to applying the MS05-054 update.
Appendix A. References
- Microsoft Security Bulletin Summary for December 2005 - http://www.microsoft.com/technet/security/bulletin/ms05-dec.mspx
- Microsoft Security Bulletin MS05-054 - http://www.microsoft.com/technet/security/bulletin/MS05-054.mspx
- Microsoft Security Bulletin MS05-052 - http://www.microsoft.com/technet/security/bulletin/MS05-052.mspx
- Microsoft Security Bulletin MS05-038 - http://www.microsoft.com/technet/security/bulletin/MS05-038.mspx
- Microsoft Security Bulletin MS05-037 - http://www.microsoft.com/technet/security/bulletin/MS05-037.mspx
- US-CERT Vulnerability Note VU#887861 - http://www.kb.cert.org/vuls/id/887861
- US-CERT Vulnerability Note VU#959049 - http://www.kb.cert.org/vuls/id/959049
- US-CERT Vulnerability Note VU#680526 - http://www.kb.cert.org/vuls/id/680526
- CVE-2005-1790 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1790
- CVE-2005-2127 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2127
- CERT/CC Malicious Web Scripts FAQ - http://www.cert.org/tech_tips/malicious_code_FAQ.html#ie56
- Improve the safety of your browsing and e-mail activities - http://www.microsoft.com/athome/security/online/browsing_safety.mspx
- Security Essentials - http://www.microsoft.com/athome/security/protect/default.aspx
- Microsoft Update - https://update.microsoft.com/microsoftupdate/
Feedback can be directed to the US-CERT Technical Staff.
December 13, 2005: Initial release, added workaround for ActiveX use in Trusted Sites Zone
December 23, 2005: Updated Solution to disable ActiveX and apply update