Vulnerability: Vulnerability in Internet Explorer Could Allow Remote Code Execution (979352)
Back to Latest vulnerabilities homepage
Click any highlighted term for further explanation.
| Details | |
|---|---|
| Vulnerability name/brief description |
Vulnerability in Internet Explorer Could Allow Remote Code Execution (979352) - Operation Aurora |
| CVE/CAN name | CVE-2010-0249 |
| Vendor threat level | Critical |
| SophosLabs threat level | High |
| Solution | |
| Vendor description |
Microsoft is investigating a report of a publicly exploited vulnerability in Internet Explorer. This advisory contains information about which versions of Internet Explorer are vulnerable as well as workarounds and mitigations for this issue. Our investigation so far has shown that Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 is not affected, and that Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6, Internet Explorer 7 and Internet Explorer 8 on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are affected. The vulnerability exists as an invalid pointer reference within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution. |
| SophosLabs comments |
The announcement of this vulnerability affecting Internet Explorer comes after reports of attacks also known as Operation Aurora targeting several large corporations, including Google and Adobe, originating from China. The alleged target of attacks on Google were Gmail accounts of Chinese human rights activists and the attacks may have used the announced vulnerability in Internet Explorer. SophosLabs have acquired samples of the exploits and have included detection Troj/ExpJS-N for all Sophos products. Since proof of concept exploits are now available in at least one exploit development framework, widespread attacks are imminent. |
| SophosLabs testing result | Sophos buffer overflow protection included in Sophos Endpoint Security proactively detects all currently known exploit samples. |
| Currently known exploits | Troj/ExpJS-N CVE-2010-0249 |
| First sample seen | N/A |
| Discovery date | 14th January 2010 |
| Affected software |
Internet Explorer 6 SP1 |
| References |
http://www.microsoft.com/technet/security/bulletin/MS10-002.mspx |
| Credits | MAPP |
|
Revisions |
21 January 2010 - Patch information added. SophosLabs threat level reduced to High in light of patch release. 19 January 2010 - Buffer overflow protection testing results added, SophosLabs threat level increased to Critical 18 January 2010 - Exploit detection details added 15 January 2010 - Initial analysis written |
Explanation of terms
Vulnerability Name/Brief Description:
Vendor identifier plus a brief description of the type of attack.
CVE/CAN Name:
Currently assigned CVE name. If a CVE name doesn't exist the CAN name will be used until a CVE has been assigned.
Vendor Threat Level:
Threat level assigned by the vendor
SophosLabs Threat Level:
Threat level assigned by SophosLabs
- LOW RISK - There is little chance of this vulnerability being actively exploited by malware.
- MEDIUM RISK - There is a possibility of this vulnerability being actively exploited by malware.
- HIGH RISK - There is a strong possibility of this vulnerability being actively exploited by malware.
- CRITICAL RISK - This vulnerability will almost certainly be actively exploited by malware.
Solution:
Vendor-supplied Patch identifier and recommended solution, or workaround if applicable.
Vendor Description:
Summary of the cause and potential effect of the vulnerability provided by the vendor.
SophosLabs Comments:
SophosLabs' opinions and observations of the vulnerability in question.
SophosLabs Testing Result:
Details of completed lab testing, if applicable. Please note that the lab test environment may differ significantly from user environments.
Currently Known Exploits:
List of identities for known exploits, if applicable.
First Sample Seen:
Date of the first sample seen by SophosLabs.
Discovery Date:
Date of the earliest known publically disclosed advisory.
Affected Software:
Vulnerable platforms and software versions.
If you need more information or guidance, then please contact technical support.
- Article ID: 67851
- Created: 15 Jan 2010
- Last updated: 29 Sep 2010
