Security Intelligence Operations

Microsoft Internet Explorer contains a vulnerability that could allow an unauthenticated, remote attacker to bypass cross-domain security restrictions.

The vulnerability exists due to insufficient cross-domain security restrictions when handling certain HTML elements.  An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to visit a malicious website.  An exploit could allow the attacker to execute arbitrary code on systems with Internet Explorer 6 SP1 and prior or disclose information on systems with Internet Explorer 7.

Microsoft has confirmed this vulnerability and released updated software.

Microsoft Internet Explorer versions 6.0 SP1 and prior and Internet Explorer 7.0 are vulnerable on the following operating systems:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 for Itanium-based Systems SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior
• Windows Vista SP1 and prior
• Windows Vista x64 Edition SP1 and prior
• Windows Server 2008 for 32-bit Systems
• Windows Server 2008 for x64-based Systems
• Windows Server 2008 for Itanium-based Systems

Attackers cannot directly exploit this vulnerability and instead rely on user interaction.  An attacker must convince a user to visit a malicious website, likely by providing a URL in an e-mail message to a user.  If successful, the attacker could execute arbitrary code with the privileges of the user or disclose sensitive information, depending on the version of Internet Explorer and the operating system.

Microsoft rates this vulnerability as Critical only for Internet Explorer versions 6.0 SP1 and prior when they are running on Windows 2000 SP4 and prior.  An exploit on other systems and application versions could only allow an attacker to access sensitive information because those systems have higher default security configurations.  Windows Server 2003 and Windows Server 2008 systems running Internet Explorer are also at a reduced risk for exploitation because of the Enhanced Security Configuration mode.  The Enhanced Security Configuration mode sets the Internet security level to High by default, reducing the impact for web pages that are not yet included in the trusted sites zone.  Systems that are running Windows XP SP2 or later may also be at a reduced risk due to the Local Machine zone lockdown security enhancement.  This enhancement may help mitigate this vulnerability if an attacker targets the Local Machine security zone.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2008 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin for October 2008

Microsoft has corrected this vulnerability by enforcing cross-domain security policy properly when executing scripts.

Microsoft has released a security bulletin at the following link: MS08-058