Microsoft Internet Explorer VML Buffer Overflow
- Microsoft Windows
- Microsoft Internet Explorer
Microsoft Internet Explorer (IE) fails to properly handle Vector Markup Language (VML) tags. This creates a buffer overflow vulnerability that could allow a remote attacker to execute arbitrary code.
Microsoft Internet Explorer contains a stack buffer overflow in code that handles VML. More information is available in Vulnerability Note VU#416092, Microsoft Security Advisory (925568), and Microsoft Security Bulletin MS06-055.
Note that this vulnerability is being exploited.
By convincing a user to open a specially crafted HTML document, such as a web page or HTML email message, a remote attacker could execute arbitrary code with the privileges of the user running IE.
Apply update from Microsoft
Microsoft has provided an update to correct this vulnerability in Microsoft Security Bulletin MS06-055.
This update is available on the Microsoft Update site.
System administrators may wish to consider using Windows Server Update Services (WSUS).
Disable VML supportMicrosoft Security Advisory (925568) suggests the following techniques to disable VML support:
- Un-register Vgx.dll on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1
- Modify the Access Control List on Vgx.dll to be more restrictive
- Configure Internet Explorer 6 for Microsoft Windows XP Service Pack 2 to disable Binary and Script Behaviors in the Internet and Local Intranet security zone
Render email as plain text
Microsoft Security Advisory (925568) suggests configuring Microsoft Outlook and Outlook Express to render email messages in plain text format.
Do not follow unsolicited links
In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.
- Vulnerability Note VU#416092 - http://www.kb.cert.org/vuls/id/416092
- Microsoft Security Bulletin MS06-055 - http://www.microsoft.com/technet/security/bulletin/ms06-055.mspx
- Microsoft Security Advisory (925568) - http://www.microsoft.com/technet/security/advisory/925568.mspx
- Securing Your Web Browser - http://www.us-cert.gov/reading_room/securing_browser/#Internet_Explorer
- Microsoft Update - https://update.microsoft.com/microsoftupdate/
- CVE-2006-3866 - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3866
September 19, 2006: Initial release
September 21, 2006: Fixed misspelling and removed IE-specific language from Solution section
September 26, 2006: Added update information and added a reference to Microsoft Update