-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0126 -- AUSCERT ALERT
                                   [Win]
A serious vulnerability has been identified in Microsoft Internet Explorer
                             12 December 2008

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Microsoft Internet Explorer 8 Beta 2
                      Microsoft Internet Explorer 7
                      Microsoft Internet Explorer 6 Service Pack 1
                      Microsoft Internet Explorer 6
                      Microsoft Internet Explorer 5.01 Service Pack 4
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-4844

Revision History:     December 12 2008: Updated to include versions of
                                        Internet Explorer other than 7, as 
                                        well as additional mitigation 
                                        information
                      December 11 2008: Initial Release

OVERVIEW:

      A serious vulnerability has been identified in Microsoft Internet 
      Explorer 7, which is currently being exploited in the wild.


IMPACT:

      This vulnerability could allow the remote execution of arbitrary code
      when visiting potentially malicious web sites. [1]


MITIGATION:

      As a patch has not been released at the time of this publication,
      it is highly recommended that users consider using a web browser other 
      than Internet Explorer until a patch becomes available. 
     
      The vendor has provided a number of workarounds:
      * Set Internet and Local intranet security zone settings to "High" to 
        prompt before running ActiveX Controls and Active Scripting in these 
        zones
      * Configure Internet Explorer to prompt before running Active Scripting 
        or to disable Active Scripting in the Internet and Local intranet 
        security zone
      * Enable DEP for Internet Explorer 7
      * Use ACL to disable OLEDB32.DLL
      * Unregister OLEDB32.DLL
      * Disable Data Binding support in Internet Explorer 8

      For the details of these workarounds, please see the Microsoft Security 
      Advisory (961051). [1]

      Users should run as a "limited user" in order to reduce the impact of 
      any potential exploitation.  

      Additionally, organisations may like to consider the use of commercially
      available IDS signatures, or other signatures such as those provided by
      Emerging Threats. [2]


REFERENCES:

      [1] Microsoft Security Advisory (961051) Vulnerability in Internet 
          Explorer Could Allow Remote Code Execution
          http://www.microsoft.com/technet/security/advisory/961051.mspx
      
      [2] CVS log for sigs/CURRENT_EVENTS/CURRENT_IE_0Day
          http://www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/CURRENT_EVENTS/CURRENT_IE_0Day

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSUHkgCh9+71yA2DNAQKpWAP9F9oSe1I7Wozey4nrZz8mW5Yj/KEpjFHw
iP0vM6G+TXGS/MLySqXTexJ56DJoECQ7b8XnV2tKOejtJZRCBaSy3+c+MhZ5x6N+
FcrlVD1i/IQUdP2HyhbzQhlC5tWFNJzBui754g2sNiZiBzEi+qHgfPU3qDlygZUa
1ISDQZ9ARAk=
=j/pM
-----END PGP SIGNATURE-----