Security Intelligence Operations

Microsoft Internet Explorer versions 5.01 SP4 and prior, 6.0 SP2 and prior, and 7.0 contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code or cause the browser to terminate.

This vulnerability exists due to improper IObjectSafety properties on affected ActiveX controls. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to visit a malicious website that is designed to use the affected ActiveX control. If successful, this ActiveX control may trigger a corruption of system memory, which could allow the attacker to execute arbitrary code with the privileges of the user.

Microsoft confirmed this vulnerability in a security bulletin and released software updates.

Microsoft Internet Explorer versions 5.01 SP4 and prior, 6.0 SP2 and prior, and 7.0 are vulnerable on the following operating systems:

• Microsoft Windows 2000 SP4 and prior
• Microsoft Windows XP SP2 and prior
• Microsoft Windows XP Professional x64 Edition SP2 and prior
• Microsoft Windows Server 2003 SP2 and prior
• Microsoft Windows Server 2003 for Itanium-based Systems SP2 and prior
• Microsoft Windows Server 2003 x64 Edition SP2 and prior
• Microsoft Windows Vista
• Microsoft Windows Vista x64

The systems most at risk to exploits of this vulnerability are development systems that contain Microsoft Visual Basic or Visual Studio. Attackers must rely on user interaction to exploit this vulnerability. If an exploit is successful, the attacker could execute arbitrary code with the privileges of the user who launched Internet Explorer. On systems that grant users Administrator privileges, the attacker could take complete control over an affected system.

The update available from Microsoft corrects this vulnerability by preventing the vulnerable ActiveX control from running within Internet Explorer.

Microsoft has released a security bulletin at the following link: MS07-045