Security Intelligence Operations

Microsoft Internet Explorer 5.01 SP4 and prior, Internet Explorer 6 SP2 and prior, and Internet Explorer 7 and 8 contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the user.

This vulnerability exists due to errors in handling variable arguments within HTML components processed by Internet Explorer. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious website. If successful, the attacker could execute arbitrary code.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates.

Microsoft Internet Explorer 5.01 SP4 and prior, Internet Explorer 6 SP2 and prior, and Internet Explorer 7 and 8 are vulnerable when running on the following affected Windows products:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior
• Windows Server 2003 for Itanium-based Systems SP2 and prior
• Windows Vista SP2 and prior
• Windows Vista x64 Edition SP2 and prior
• Windows Server 2008 for 32-bit Systems SP2 and prior
• Windows Server 2008 for x64-based Systems SP2 and prior
• Windows Server 2008 for Itanium-based Systems SP2 and prior

Attackers cannot directly exploit this vulnerability and instead require user participation.  An attacker must convince a user to view malicious HTML content within Internet Explorer.  The attacker may send links to malicious websites via e-mail messages, or embed malicious content within public websites in order to launch exploits against any users visiting the site.

If an exploit is successful, the attacker could execute arbitrary code.  Systems that grant users elevated privileges are at most risk, as any executed code as a result of exploitation would occur with the privileges of the user.  An exploit on a system that grants users Administrator privileges could result in a complete system compromise.  Systems that restrict user privileges or have built-in user privilege separation are at less risk because executed code would run with limited privileges.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2009 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for October 2009