Security Intelligence Operations

The following Microsoft Internet Explorer versions contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the user:

Internet Explorer 5.01 SP4 and prior
Internet Explorer 6 SP2 and prior
Internet Explorer 7

This vulnerability is due to errors when Internet Explorer handles malformed data stream headers. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious website. If the user views the site, the attacker could execute arbitrary code on the affected system.

Proof-of-concept exploit code is publicly available to cause a denial of service condition.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates.

Microsoft Internet Explorer 5.01 SP4 and prior, Internet Explorer 6 SP2 and prior, and Internet Explorer 7 are vulnerable when running on the following affected Windows products:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior
• Windows Server 2003 for Itanium-based Systems SP2 and prior
• Windows Vista SP2 and prior
• Windows Vista x64 Edition SP2 and prior
• Windows Server 2008 for 32-bit Systems SP2 and prior
• Windows Server 2008 for x64-based Systems SP2 and prior
• Windows Server 2008 for Itanium-based Systems SP2 and prior

Attackers rely on user interaction to accomplish an exploit.  The attacker must convince the user to view a malicious website.  Attackers may provide links to malicious sites within e-mail messages to users, or embed malicious content within public websites, often in advertising.

If an exploit is successful, the attacker could execute arbitrary code with the privileges of the user.  If the user holds elevated privileges, the attacker could completely compromise the system.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2009 security bulletin release.  This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for October 2009

The update available from Microsoft corrects this vulnerability by improving the processing of stream headers.