HOME > VULNERABILITY NOTES


   VULNERABILITY NOTE

 

CERT-In Vulnerability Note CIVN-2010-66
Microsoft Internet Explorer "iepeers.dll" remote code execution vulnerability

Original Issue Date: March 11, 2010
Updated: March 30, 2010

Severity Rating: High

System Affected

  • Microsoft Windows 2000 SP4
  • Windows XP SP 2 and Windows XP SP 3
  • Windows XP Professional x64 Edition SP 2
  • Windows Server 2003 SP 2
  • Windows Server 2003 x64 Edition SP 2
  • Windows Server 2003 with SP2 for Itanium-based Systems
  • Windows Vista, SP 1& SP 2
  • Windows Vista x64 Edition ,SP 1& SP 2
  • Windows Server 2008 for 32-bit Systems & SP 2
  • Windows Server 2008 for x64-based Systems & SP 2
  • Windows Server 2008 for Itanium-based Systems & SP 2

Components Affected

  • Internet Explorer 6 & SP1
  • Internet Explorer 7

Overview

A use-after -free vulnerability has been reported Microsoft Internet Explorer iepeers.dll file that could allow an attacker to execute arbitrary code in the privileges of the logged in user.

Description

The vulnerability is due to an invalid pointer reference by the iepeers.dll file (provides webfolder and printing services for IE) which access an invalid pointer associated with a deleted object. A remote ,unauthenticated attacker can exploit this vulnerability by persuading a user to visit a specially crafted website and leads to remote code execution.

Workarounds

  • Disable ActiveX Controls in Office 2007
  • Disable the peer factory class by editing the registry keys for iepeers.dll
  • Modify the Access Control List (ACL) on iepeers.dll
  • Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones
  • Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
  • Enable DEP for Internet Explorer 6 Service Pack 2 or Internet Explorer 7
  • Do not open unexpected files

For detailed steps of these workarounds refer to Microsoft Security Advisory 981374

 

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin MS10-018

Vendor Information

Microsoft
http://www.microsoft.com/technet/security/advisory/981374.mspx
http://www.microsoft.com/technet/security/Bulletin/MS10-018.mspx

References

Microsoft
http://www.microsoft.com/technet/security/advisory/981374.mspx
http://support.microsoft.com/kb/979352

CISCO
http://tools.cisco.com/security/center/viewAlert.x?alertId=19726

SecurityTracker
http://securitytracker.com/alerts/2010/Mar/1023699.html

ISS XFORCE
http://xforce.iss.net/xforce/xfdb/56772

CVE Name
CVE-2010-0806

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information


Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Communications and Information Technology
Electronics Niketan
6, C.G.O. Complex
New Delhi-110 003