Overview
A code execution vulnerability is present in some versions of Microsoft Internet Explorer.
A code execution vulnerability is present in some versions of Microsoft Internet Explorer. The flaw resides in Internet Explorer's handling of certain DOM operations. Internet Explorer improperly access objects which have been deleted or incorrectly initialized. Successful exploitation could allow an attacker to execute arbitrary code. Exploitation can be achieved via a maliciously crafted file, or via a maliciously-crafted web page. Failed exploit attempts may result in an application crash (DoS). DEP and JavaScript ------------------- McAfee Labs has confirmed that this vulnerability affects Microsoft Internet Explorer versions 6,7,and 8. However, currently observed exploits (1/14/2009) will only succeed in Internet Explorer installations where DEP (Data Execution Prevention) is *NOT* enabled. In addition, JavaScript must be enabled to allow successful exploitation. DEP is enabled by default in Internet Explorer 8, while Internet Explorer 7 contains a feature to enable DEP. Disabling JavaScipt, while enabling DEP, will inhibit the success of exploits which are currently in-the-wild.
Attack VectorWebsite or e-mail with malicious content
User Interactionuser interaction is needed
Vendor StatusResponded and patched
Vulnerable Systems
Internet Explorer
8,
Timeline
Exploit code has been released.
2010-01-14Exploit code has been released.
2010-01-14Vendor has provided information on the vulnerability.
2010-01-15A proof of concept has been released.
2010-01-18A proof of concept has been released.
2010-01-21Vendor has provided a patch.
2010-02-03A proof of concept has been released.
2020-01-14Vulnerability information has been publicly disclosed.
Recommendations
The vendor has released an update to address this issue:
http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx
Recommendations McAfee Product Mitigation
Additional Resources
Microsoft Security Bulletin MS10-002 - Critical Cumulative Security Update for Internet Explorer (978207)
http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx