Vulnerability in Microsoft XML HTTP Request Handling
| Notification Type: | Internet Security Systems Protection Alert |
| Notification Date: | November 4, 2006 |
| Notification Version: | 1.3 |
| Name: | Vulnerability in Microsoft XML HTTP Request Handling |
| Public disclosure/ In the wild date: |
November 3, 2006 |
| Description: | ISS X-Force was the first research group to discover active exploitation of an undislosed vulnerability in Microsoft’s XML HTTP request handling. Current exploitation of this vulnerability through Internet Explorer. Specifically, these exploits target Internet Explorer through a vulnerable ActiveX control. Successful exploitation of this vulnerability may result in remote code execution. All ISS IPS/IDS products and host products had pre-emptive protection against this threat through heuristic Javascript/Shellcode exploit detection signatures and through Buffer Overflow Exploit Prevention (BOEP). In addition to this pre-emptive protection, ISS has provided a third IPS/IDS signature to prevent this specific vulnerability from being exploited. Our web-filtering technology is automatically updated to protect against malicious sites that attempt to host this kind of malicious material. Every customer using our filtering technology or database of URL's was protected within moments of this discovery in early Nov. |
ISS Coverage |
|||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||
Detailed Description |
|||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||
References |
|||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||
Revision History |
|||||||||||||||||||||||||||||||||||||||||
|
Version 1.0 November 4, 2006 - Initial alert release Version 1.1 November 6, 2006 - Added confirmation that buffer overflow exploit prevention stopped these exploits Version 1.2 November 7, 2006 - Changed affected versions to focus on vulnerable component and added additional coverage information Verison 1.3 November 8, 2006 - Added content filtering information and converted to new alert format. |
|||||||||||||||||||||||||||||||||||||||||
|
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
About IBM Internet Security SystemsIBM Internet Security Systems is a trusted security advisor to thousands of the world's leading businesses and governments, helping to provide pre-emptive protection for networks, desktops and servers. The IBM Proventia® integrated security platform is designed to automatically protect against both known and unknown threats, helping to keep networks up and running and shield customers from online attacks before they impact business assets. IBM Internet Security Systems products and services are based on the proactive security intelligence of its X-Force® research and development team an unequivocal world authority in vulnerability and threat research. The IBM Internet Security Systems product line is also complemented by comprehensive Managed Security Services and Professional Security Services. For more information, visit the IBM Internet Security Systems Web site at www.iss.net or call 800-776-2362. |
|||||||||||||||||||||||||||||||||||||||||