Security Intelligence Operations

Microsoft Internet Explorer contains a vulnerability that could allow an unauthenticated, remote attacker to cause a crash of the affected browser or execute arbitrary code.

This vulnerability exists due to insufficient processing of HTML elements.  An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious website.  If successful, the attacker could cause Internet Explorer to terminate or execute arbitrary code with the privileges of the user.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates.

Microsoft Internet Explorer versions 5.01 SP4 and prior and Internet Explorer 6.0 SP1 and prior are vulnerable on the following operating systems:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 for Itanium-based Systems SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior

To exploit this vulnerability, an attacker must convince a user to open malicious HTML content in an affected browser application.  This action likely requires user interaction.  However, the attacker may be able to exploit the vulnerability without direct user interaction by injecting malicious HTML content within public, third-party sites.  The attacker may also attempt to direct users to malicious sites by convincing them to follow a provided link.

If an exploit is successful, the attacker could execute arbitrary code with the privileges of the user.  If that user holds Administrator privileges, the attacker could execute code resulting in a complete system compromise.  Systems that restrict user privileges may be less at risk in the event of an exploit because any code execution would run with limited privileges.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for October 2008 

Microsoft has corrected the vulnerability by modifying the way HTML elements are processed within Internet Explorer.

Microsoft has released a security bulletin at the following link: MS08-058