Security Intelligence Operations

Microsoft Internet Explorer 6 SP2 and prior, Internet Explorer 7, and Internet Explorer 8 contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the user.

The vulnerability is due to invalid memory operations by Internet Explorer. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious website. If the user views the site, the attacker could execute arbitrary code on the affected system.

Microsoft has confirmed this vulnerability in a security bulletin and released software updates.

Microsoft Internet Explorer 6 SP2 and prior, Internet Explorer 7, and Internet Explorer 8 are vulnerable when running on the following affected Windows products:

• Windows 2000 SP4 and prior
• Windows XP SP3 and prior
• Windows XP Professional x64 Edition SP2 and prior
• Windows Server 2003 SP2 and prior
• Windows Server 2003 x64 Edition SP2 and prior
• Windows Server 2003 for Itanium-based Systems SP2 and prior
• Windows Vista SP2 and prior
• Windows Vista x64 Edition SP2 and prior
• Windows Server 2008 for 32-bit Systems SP2 and prior
• Windows Server 2008 for x64-based Systems SP2 and prior
• Windows Server 2008 for Itanium-based Systems SP2 and prior

An attacker cannot exploit this vulnerability without user interaction.  The attacker must lure the user into viewing a malicious HTML document.  To facilitate an exploit, the attacker may use social engineering techniques in an attempt to convince the user to view malicious content.  An attacker may provide links to users via e-mail messages and adjust text to make users believe the message comes from a trusted source.  The attacker may also embed content on public websites in an attempt to launch exploits against any users who visit the site on their own.

If an exploit is successful, the attacker could execute arbitrary code with the privileges of the user.  On systems that grant users elevated privileges, an exploit could allow the attacker to completely compromise the system.  On systems that restrict user privileges, an exploit may have a reduced effect because any executed code would run with limited privileges.

Cisco has re-released the Applied Mitigation Bulletin that addresses the Microsoft Security Bulletin Release for October 2009. This update reports intrusion prevention system activity that is related to the Microsoft Internet Explorer uninitialized memory access vulnerability. The data, which was captured on October 27, 2009, could indicate that the vulnerability is not showing signs of being exploited in the wild.

The Cisco Applied Intelligence team has created an Applied Mitigation Bulletin to address vulnerabilities that Microsoft disclosed in the October 2009 security bulletin release. This Cisco bulletin, which assists administrators in identifying or mitigating these vulnerabilities using Cisco devices, is available at the following link: Cisco Applied Mitigation Bulletin: Microsoft Security Bulletin Release for October 2009