McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → McAfee Labs → Threat Intelligence

Microsoft Internet Explorer STYLE Object Code Execution Vulnerability (977981)

Threat Detail

Vulnerability Type: Logic error

Impact of Exploitation: Website with malicious content

CVE Reference: N/A

Next Steps:

Overview

A vulnerability in Microsoft Internet Explorer may allow remote code execution.

A vulnerability in Microsoft Internet Explorer may allow remote code execution. Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via vectors involving a call to the getElementsByTagName method for the STYLE tag name, selection of the single element in the returned list, and a change to the outerHTML property of this element Exploitation can be achieved via a specially-crafted web page. Failed exploit attempts may result in an application crash (denial-of-service)

Attack Vector

Website with malicious content

User Interaction

user interaction is needed

Vendor Status

Responded, not patched

Vulnerable Systems

Internet Explorer   7 Windows XP Professional X64 Edition SP2,

Timeline

2009-11-20

A proof of concept has been released.

2009-11-20

Vulnerability information has been publicly disclosed.

2009-11-21

Vulnerability information has been publicly disclosed.

2009-11-23

Vendor has provided information on the vulnerability.

Recommendations

McAfee is currently unaware of a vendor-supplied patch or update (11/23/2009).

Recommendations McAfee Product Mitigation

Additional Resources

Microsoft Security Advisory (977981) Vulnerability in Internet Explorer Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/977981.mspx

Microsoft Security Advisory (977981) Vulnerability in Internet Explorer Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/977981.mspx

United States - English