[ISN] Microsoft Rocked by New IE Zero-Day Flaw Warning

[InfoSec News]

http://www.eweek.com/article2/0,1895,1953833,00.asp

By Ryan Naraine 
April 25, 2006 

Barely two weeks after shipping an Internet Explorer security makeover
to cover a wave of drive-by malware downloads, Microsoft is scrambling
to address the public disclosure of a new zero-day vulnerability that
could be used in code execution attacks.

The Redmond, Wash. software maker confirmed it was investigating a
warning posted on the Full-disclosure mailing list that the latest
versions of IE causes various types of crashes when visiting Web pages
with nested OBJECT tags.

A spokesman for Microsoft said the initial investigation has revealed
that the bug would most likely result in the browser closing
unexpectedly or failing to respond.

"Microsoft will continue to investigate the public reports to help
provide additional guidance for customers as necessary."

Michal Zalewski, the researcher who discovered the flaw and published
the advisory without notifying Microsoft, said the issue was confirmed
on fully patched versions of IE 6.0 and Microsoft Windows XP SP2
(Service Pack 2).

"At first sight, this vulnerability may offer a remote compromise
vector, although not necessarily a reliable one," Zalewski said.

He described the error as "convoluted and difficult to debug" but
warned that the risk of a code execution attack scenario can't be
ruled out.

"As such, panic, but only slightly," Zalewski said.

Security alerts aggregator Secunia flagged the issue as "highly
critical" and stressed that it can be exploited to corrupt memory by
tricking a user into visiting a malicious Web site. "Successful
exploitation allows execution of arbitrary code," Secunia warned.

FrSIRT (French Security Incident Response Team) also slapped a
"critical" rating on the flaw because of the risk it presents to IE
users. In an alert, FrSIRT said the bug could be exploited by remote
attackers to execute arbitrary commands.

"This flaw is due to a memory corruption error when processing a
specially crafted HTML script that contains malformed "object" tags,
which could be exploited by attackers to remotely take complete
control of an affected system by convincing a user to visit a
specially crafted Web page," the research firm said.

Researchers at Websense Security Labs said there are no published
proof-of-concepts demonstrating a remote code execution attack vector
but made it clear that browser crash vulnerabilities often lead to
remote code execution exploits.

"We are currently scanning for sites which attempt to leverage this
vulnerability," the company said.

Microsoft chided Zalewski for jumping the gun and posting his findings
before a comprehensive patch could be created, but the researcher is
unapologetic.

"I didn't give an advance notification to Microsoft, because I
strongly oppose their handling of the vulnerability patching process.  
Although I can't make a difference, it's the tiny bit of civil
disobedience I can afford whenever I can reasonably believe that no
immediate harm would be done to third parties," Zalewski wrote in an
e-mail exchange with eWEEK.

"I believe that, among other things, Microsoft resorts to borderline
extortion practices when dealing with vulnerability researchers who
work for companies that in any way depend on Microsoft; they delay
disclosure of problems by sometimes taking in excess of 100 days to
fix trivial flaws [which cannot be justified in any way]," he added.

"[They] often attempt to downplay threats; they don't participate in
the vulnerability research community in a meaningful way; and they
routinely use false pretenses when communicating their expectations to
the media (for example, expressing concern for the customer and
blaming the researcher where the chief risk for the customer arises
from the fact that an extremely wealthy and profitable software giant
severely underfunds the task of fixing critical defects in their
software)," Zalewski wrote.