-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2010.1176
   Vulnerability in Internet Explorer Could Allow Remote Code Execution
                             23 December 2010

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Internet Explorer 6
                   Internet Explorer 7
                   Internet Explorer 8
Publisher:         Microsoft
Operating System:  Windows XP
                   Windows Vista
                   Windows 7
                   Windows Server 2003
                   Windows Server 2008
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:        Mitigation
CVE Names:         CVE-2010-3971  

Original Bulletin: 
   http://www.microsoft.com/technet/security/advisory/2488013.mspx

Comment: While Microsoft has yet to release an update correcting this 
         vulnerability, they have stated that an update will follow either
         through their monthly update release process, or via an out-of-cycle
         update. Microsoft has in the meantime provided some mitigation to 
         help aleviate the impact of this vulnerability.

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Advisory (2488013)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
Published: December 22, 2010

Version: 1.0

General Information

Executive Summary

Microsoft is investigating new, public reports of a vulnerability in all 
supported versions of Internet Explorer. The main impact of the vulnerability 
is remote code execution. This advisory contains workarounds and mitigations 
for this issue.

The vulnerability exists due to the creation of uninitialized memory during a 
CSS function within Internet Explorer. It is possible under certain 
conditions for the memory to be leveraged by an attacker using a specially 
crafted Web page to gain remote code execution.

On completion of this investigation, Microsoft will take the appropriate 
action to protect our customers, which may include providing a solution 
through our monthly security update release process, or an out-of-cycle 
security update, depending on customer needs. Currently, Microsoft is unaware 
of any active exploitation of this vulnerability.

We are actively working with partners in our Microsoft Active Protections 
Program (MAPP) and our Microsoft Security Response Alliance (MSRA) programs to 
provide information that they can use to provide broader protections to 
customers. In addition, we are actively working with partners to monitor the 
threat landscape and take action against malicious sites that attempt to 
exploit this vulnerability.

Microsoft continues to encourage customers to follow the "Protect Your 
Computer" guidance of enabling a firewall, applying all software updates and 
installing anti-virus and anti-spyware software. Additional information can 
be found at Security at home. 

Mitigating Factors:
	
Protected Mode in Internet Explorer on Windows Vista and later Windows 
operating systems helps to limit the impact of currently known exploits. An 
attacker who successfully exploits this vulnerability would have very limited 
rights on the system.
	
By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 
runs in a restricted mode that is known as Enhanced Security Configuration. 
This mode sets the security level for the Internet zone to High. This is a 
mitigating factor for Web sites that you have not added to the Internet 
Explorer Trusted sites zone. See also Managing Internet Explorer Enhanced 
Security Configuration.
	
By default, all supported versions of Microsoft Outlook, Microsoft Outlook 
Express, and Windows Mail open HTML e-mail messages in the Restricted sites 
zone, which disables script and ActiveX controls, reducing the risk of an 
attacker being able to use this vulnerability to execute malicious code. If a 
user clicks a link in an e-mail message, the user could still be vulnerable 
to exploitation of this vulnerability through the Web-based attack scenario.
	
An attacker who successfully exploits this vulnerability could gain the same 
user rights as the local user. Users whose accounts are configured to have 
fewer user rights on the system could be less affected than users who operate 
with administrative user rights.
	
In a Web-based attack scenario, an attacker could host a Web site that contains 
a Web page that is used to exploit this vulnerability. In addition, compromised 
Web sites and Web sites that accept or host user-provided content or 
advertisements could contain specially crafted content that could exploit this 
vulnerability. In all cases, however, an attacker would have no way to force 
users to visit these Web sites. Instead, an attacker would have to convince 
users to visit the Web site, typically by getting them to click a link in an 
e-mail message or Instant Messenger message that takes users to the attackers 
Web site.

Issue References
References	Identification
CVE Reference	CVE-2010-3971

Affected Software

Internet Explorer 6
Internet Explorer 7 
Internet Explorer 8
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems	
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition 
  Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition 
  Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit 
  Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for 
  x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for 
  Itanium-based Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFNEsCG/iFOrG6YcBERAkTSAJ98K1XcybBCpfQI/W2qTqKQLVewCQCg18fl
AB+MZMWwAq1KoyvLA/aT9Go=
=O2LX
-----END PGP SIGNATURE-----