=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2010/VULN436
_____________________________________________________________________

DATE                      : 05/11/2010

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Microsoft Internet Explorer versions 6, 7, 8.

======================================================================
http://www.microsoft.com/technet/security/advisory/2458511.mspx
______________________________________________________________________

Microsoft Security Advisory (2458511)

Vulnerability in Internet Explorer Could Allow Remote Code Execution

Version: 1.0

General Information

Executive Summary

Microsoft is investigating new, public reports of a vulnerability in all
supported versions of Internet Explorer. The main impact of the vulnerability
is remote code execution. This advisory contains workarounds and mitigations
for this issue.

The vulnerability exists due to an invalid flag reference within Internet
Explorer. It is possible under certain conditions for the invalid flag
reference to be accessed after an object is deleted. In a specially-crafted
attack, in attempting to access a freed object, Internet Explorer can be
caused to allow remote code execution.

At this time, we are aware of targeted attacks attempting to use this
vulnerability. We will continue to monitor the threat environment and update
this advisory if this situation changes. On completion of this investigation,
Microsoft will take the appropriate action to protect our customers, which
may include providing a solution through our monthly security update release
process, or an out-of-cycle security update, depending on customer needs.

We are actively working with partners in our Microsoft Active Protections
Program (MAPP) and our Microsoft Security Response Alliance (MSRA) programs
to provide information that they can use to provide broader protections to
customers. In addition, we are actively working with partners to monitor the
threat landscape and take action against malicious sites that attempt to
exploit this vulnerability.

Microsoft continues to encourage customers to follow the "Protect Your
Computer" guidance of enabling a firewall, applying all software updates and
installing anti-virus and anti-spyware software. Additional information can
be found at Security at home.

Mitigating Factors:

	Data Execution Prevention (DEP) helps protect against attacks that
        result in code execution and is enabled by default in Internet
        Explorer 8 on the following Windows operating systems: Windows XP
        Service Pack 3, Windows Vista Service Pack 1, Windows Vista Service
        Pack 2, and Windows 7.

	Protected Mode in Internet Explorer on Windows Vista and later
        Windows operating systems helps to limit the impact of the
        vulnerability as an attacker who successfully exploited this
        vulnerability would have very limited rights on the system. An
        attacker who successfully exploited this vulnerability on Internet
        Explorer 7 or Internet Explorer 8 could gain the same user rights as
        the local user. Users whose accounts are configured to have fewer
        user rights on the system could be less affected than users who
        operate with administrative user rights.

	In a Web-based attack scenario, an attacker could host a Web site
        that contains a Web page that is used to exploit this vulnerability.
        In addition, compromised Web sites and Web sites that accept or host
        user-provided content or advertisements could contain specially
        crafted content that could exploit this vulnerability. In all cases,
        however, an attacker would have no way to force users to visit these
        Web sites. Instead, an attacker would have to convince users to visit
        the Web site, typically by getting them to click a link in an e-mail
        message or Instant Messenger message that takes users to the attackers
        Web site.

Issue References

References				Identification
CVE Reference				CVE-2010-3962
Microsoft Knowledge Base Article	2458511

Affected Software

Internet Explorer 6
Internet Explorer 7
Internet Explorer 8
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition
  Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit
  Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based
  Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for
  Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems
======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================