|
Home   Programs Emergency management Response CCIRC Analytical releases2 AV05-36: Microsoft Internet Explorer window() Code Execution Vulnerability
Update to AV05-036
23 November 2005 Purpose
Microsoft has released a Security Advisory (911302) to address the issue reported in AV05-036: Vulnerability in the way Internet Explorer Handles Mismatched Document Object Model Objects Could Allow Remote Code Execution. Assessment
The Mircrosoft advisory adds the following to the list of affected platforms: Windows 98, Windows 98 Second Edition, and Windows Millennium Edition. Suggested action Additional workarounds: Set Internet and Local intranet security zone settings to HIGH to prompt before running Active Scripting in these zones. Restrict Web sites to only your trusted Web sites. Microsoft Security Advisory 911302: http://www.microsoft.com/technet/security/advisory/911302.mspx Advisory number: AV05-036
21 November 2005 PurposeThis is to bring attention to a recently disclosed vulnerability in Microsoft Internet Explorer that could be exploited to execute arbitrary code. AssessmentA critical vulnerability has been identified in Microsoft Internet Explorer, which could be exploited to execute arbitrary code. A memory corruption error when processing malformed HTML pages containing specially crafted calls to JavaScript "window()" objects and "body onload" tags could be exploited to execute arbitrary. However, user interaction is required. This vulnerability has been confirmed on Windows XP SP2 with Internet Explorer 6 (fully patched). Affected Products Microsoft Internet Explorer 6 for Microsoft Windows XP SP2 Microsoft Internet Explorer 6 SP1 on Microsoft Windows XP SP1 Microsoft Internet Explorer 6 SP1 on Microsoft Windows 2000 SP4 Microsoft Internet Explorer 5.01 SP4 on Microsoft Windows 2000 SP4 Suggested actionA. Do not respond to, or click on links from unsolicited e-mail. B. Disable Active Scripting in Internet Explorer: 1. Start Internet Explorer.
2. From the Tools menu, select Internet Options.
3. Select the Security tab, click on Custom Level.
4. In the Settings dialog, select the Disable button under Active scripting.
5. Click on Ok and Ok again to save your changes. Original advisory: FrSirt: http://www.frsirt.com/english/advisories/2005/2509 Note to readersPublic Safety and Emergency Preparedness Canada (PSEPC) collects information related to cyber and physical threats to, and incidents involving, Canadian critical infrastructure. This allows us to monitor and analyze threats and to issue alerts, advisories and other information products. To report threats or incidents, please contact the Government Operations Centre (GOC) at (613) 991-7000 or goc-cog@psepc-sppcc.gc.ca by e-mail. Unauthorized use of computer systems and mischief in relation to data are serious Criminal Code offences in Canada. Any suspected criminal activity should be reported to local law enforcement organizations. The Royal Canadian Mounted Police (RCMP) National Operations Centre (N.O.C.) provides a 24/7 service to receive such reports or to redirect callers to local law enforcement organizations. The N.O.C. can be reached at (613) 993-4460. National security concerns should be reported to the Canadian Security Intelligence Service (CSIS) at (613) 993-9620. For urgent matters or to report any incidents, please contact the Government Operations Centre at: Phone: (613) 991-7000
Fax: (613) 996-0995
Secure Fax: (613) 991-7094
Email: goc-cog@psepc-sppcc.gc.ca For general information on critical infrastructure protection and emergency preparedness, please contact PSEPC's Public Affairs division at: Telephone: (613) 944-4875 or 1-800-830-3118
Fax: (613) 998-9589
E-mail: communications@psepc-sppcc.gc.ca
Web: www.psepc.gc.ca
|
Printable version
Send this page