[NT] Internet Explorer DBCS Remote Memory Corruption (MS06-013)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Internet Explorer DBCS Remote Memory Corruption (MS06-013)
------------------------------------------------------------------------


SUMMARY

This vulnerability affects systems that use Double-Byte Character Sets. 
Systems that are affected are Windows language versions that use a Double 
Byte Character Set language. Examples of languages that use DBCS are 
Chinese, Japanese, and Korean languages. Customers using other language 
versions of Windows might also be affected if "Language for non-Unicode 
programs" has been set to a Double Byte Character Set language.

This vulnerability could allow an attacker to execute arbitrary code on 
the victim's system when the victim visits a web page or views an HTML 
email message. This attack may be utilized wherever IE parses HTML, such 
as webpages, email, newsgroups, and within applications utilizing 
web-browsing functionality.

DETAILS

Products affected:
 * Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service 
Pack 4 and Microsoft Windows XP Service Pack 1
 * Internet Explorer 6 for Microsoft Windows XP Service Pack 2
 * Internet Explorer 6 for Microsoft Windows Server 2003
 * Internet Explorer 6 Service Pack 1 on Microsoft Windows 98, Microsoft 
Windows 98 SE, and Microsoft Windows Millennium Edition

URLMON.DLL does not properly validate IDN containing double-byte character 
sets (DBCS), which may lead to remote code execution. Exploiting this 
vulnerability seems to need a lot of more work but we believe that
exploitation is possible.

Fix:
Microsoft has released an update for Internet Explorer which is set to 
address this issue. This can be downloaded from:
 <http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx> 
http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1189> 
CVE-2006-1189

Vendor Response:
 * 2005.12.29 - Vendor notified via [email protected]
 * 2005.12.29 - Vendor responded
 * 2006.04.11 - Vendor released MS06-0xx patch
 * 2006.04.11 - Advisory released

References:
1.  <http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx> 
http://www.microsoft.com/technet/security/bulletin/MS06-013.mspx
2.  <http://www.nsfocus.com/english/homepage/research/0008.htm> 
http://www.nsfocus.com/english/homepage/research/0008.htm
3.  <http://xforce.iss.net/xforce/xfdb/5729> 
http://xforce.iss.net/xforce/xfdb/5729
4.  <http://www.securityfocus.com/bid/2100/discuss> 
http://www.securityfocus.com/bid/2100/discuss
5.  <http://www.inter-locale.com/whitepaper/IUC27-a303.html> 
http://www.inter-locale.com/whitepaper/IUC27-a303.html
6.  <http://blogs.msdn.com/michkap/archive/2005/10/28/486034.aspx> 
http://blogs.msdn.com/michkap/archive/2005/10/28/486034.aspx
7. [Mozilla Firefox IDN "Host:" Buffer Overflow]  
<http://www.security-protocols.com/advisory/sp-x17-advisory.txt> 
http://www.security-protocols.com/advisory/sp-x17-advisory.txt
8. [Mozilla Firefox 1.5 Beta 1 IDN Buffer Overflow]  
<http://www.security-protocols.com/advisory/sp-x18-advisory.txt> 
http://www.security-protocols.com/advisory/sp-x18-advisory.txt
9. http://72.14.203.104/search?q=cache:Dxn-V4fil1IJ:developer.novell.com  
/research/devnotes/1995/may/02/05.htm


ADDITIONAL INFORMATION

The original article can be found at:  
<http://secway.org/advisory/AD20060411.txt> 
http://secway.org/advisory/AD20060411.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.