HighRealSecure Network, RealSecure Server Sensor, BlackICE PC Protection, BlackICE Server Protection, Proventia Network MFS, IBM Security Server Protection for Windows, Proventia-G 1.1 and earlier, Proventia Network IDS, RealSecure Desktop, Proventia Server IPS for Linux technology, Proventia Network IPS, Proventia Desktop, Virtual Server Protection for Vmware:
This signature detects specially-crafted server response messages that can overflow a buffer in Microsoft Internet Explorer and allow remote code execution.
This signature dectects invalid server response messages.
High
RealSecure Network: XPU 24.56, RealSecure Server Sensor: XPU 24.56, BlackICE PC Protection: 3.6cqb, BlackICE Server Protection: 3.6.cqb, Proventia Network MFS: XPU 1.95, IBM Security Server Protection for Windows: 1.0.914.1960, IBM Security Server Protection for Windows: 2.1.14.2400, Proventia-G 1.1 and earlier: XPU 24.56, Proventia Network IDS: XPU 24.56, RealSecure Desktop: eqb, Proventia Server IPS for Linux technology: 1.95, Proventia Network IPS: XPU 1.95, Proventia Desktop: 1960, Virtual Server Protection for Vmware: 1.0
Microsoft Internet Explorer: 6.0, Microsoft Internet Explorer: 6.0 SP1, Microsoft Internet Explorer: 5.01 SP4, Microsoft Windows 2000: SP4, Microsoft Windows 2003 Server: x64, Microsoft Windows XP: SP2, Microsoft Windows 2003 Server: Itanium, Microsoft Windows 2003 Server: SP1, Microsoft Windows XP: x64 Professional, Microsoft Windows 2003 Server: SP1 Itanium, Microsoft Internet Explorer: 7.0
Unauthorized Access Attempt
Microsoft Internet Explorer could allow a remote attacker to execute arbitrary code on a victim's system, caused by improper handling of FTP responses by Internet Explorer's built-in FTP client. If a remote attacker could persuade a victim to visit a malicious FTP server using Internet Explorer, the attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim.
Apply the appropriate patch for your system, as listed in the latest Microsoft Security Bulletin. See References.
— OR —
Use Microsoft Automatic Update if it is supported by your operating system. The original bulletin issued by Microsoft has been superseded.
Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)
http://www.microsoft.com/technet/security/Bulletin/MS07-016.mspx
iDefense Labs PUBLIC ADVISORY: 02.13.07
Microsoft 'wininet.dll' FTP Reply Null Termination Heap Corruption Vulnerability
https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=473
US-CERT Vulnerability Note VU#613564
Microsoft Internet Explorer fails to properly interpret certain responses from FTP servers
http://www.kb.cert.org/vuls/id/613564
Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)
http://www.microsoft.com/technet/security/bulletin/ms07-027.mspx
Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)
http://www.microsoft.com/technet/security/bulletin/ms07-033.mspx
Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)
http://www.microsoft.com/technet/security/bulletin/ms07-045.mspx
Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)
http://www.microsoft.com/technet/security/Bulletin/MS07-057.mspx
Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)
http://www.microsoft.com/technet/security/bulletin/ms07-069.mspx
Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)
http://www.microsoft.com/technet/security/bulletin/ms08-010.mspx
Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)
http://www.microsoft.com/technet/security/bulletin/ms08-024.mspx
Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)
http://www.microsoft.com/technet/security/Bulletin/MS08-031.mspx
Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)
http://www.microsoft.com/technet/security/bulletin/ms08-045.mspx
Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)
http://www.microsoft.com/technet/security/bulletin/ms08-058.mspx
ISS X-Force
Microsoft Internet Explorer FTP response code execution
http://www.iss.net/security_center/static/32100.php
CVE
CVE-2007-0217
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0217