Microsoft Internet Explorer up to 8.x VML Vector Markup Language Handler buffer overflow

VulDB: Microsoft Internet Explorer up to 8.x VML Vector Markup Language Handler buffer overflow

General

Microsoft

scipID: 4368
Affected: Microsoft Internet Explorer up to 8.x
Published: 06/14/2011
Risk: critical
Entry: 94.5% complete
Created: 06/20/2011
Updated: 09/03/2012

Summary

A vulnerability classified as critical has been found in Microsoft Internet Explorer up to 8.x. Affected is an unknown function of the component VML Vector Markup Language Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 06/14/2011 with ZDI. The advisory is shared for download at zerodayinitiative.com. This vulnerability is traded as CVE-2011-1266 since 03/04/2011. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 55132 (MS11-052: Vulnerability in Vector Markup Language Could Allow Remote Code Execution (2544521)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows : Microsoft Bulletins, running in the context local and relying on port 139.

Applying the patch MS11-052 is able to eliminate this problem. The bugfix is ready for download at microsoft.com. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the databases at Secunia (SA44920) and SecurityFocus (BID 48173).

CVSS

Base Score: 6.0 (CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P) [?]

Access Vector	Access Complexity	Authentication	Confidentiality	Integrity	Availability
Local	High	Multiple	None	None	None
Adjacent	Medium	Single	Partial	Partial	Partial
Network	Low	None	Complete	Complete	Complete

Exploiting

Class: Buffer overflow
Local: No
Remote: Yes

Availability: No

Nessus ID: 55132
Nessus Name: MS11-052: Vulnerability in Vector Markup Language Could Allow Remote Code Execution (2544521)
Nessus Family: Windows : Microsoft Bulletins
Nessus Context: local
Nessus Port: 139