{"vuid":"VU#122084","idnumber":"122084","name":"Microsoft Internet Explorer VML buffer overflow","keywords":["Microsoft","VML","Vector Markup Language","remote code execution","Web page","ms07-jan","IE","vgx.dll"],"overview":"Microsoft Internet Explorer (IE) fails to properly handle Vector Markup Language tags. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.","clean_desc":"Microsoft IE version 5.0 and higher supports the Vector Markup Language (VML), which is a set of XML tags for drawing vector graphics. IE fails to properly handle malformed VML tags allowing a buffer overflow to occur. If a remote attacker can persuade a user to access a specially crafted web page with IE, that attacker may be able to trigger the buffer overflow. In addition, an attacker could deliver an HTML email message or entice a user to select an HTML document in Windows Explorer. Note that this vulnerability is actively being exploited.","impact":"By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer (or the program using the WebBrowser control) to crash.","resolution":"Apply the update from Microsoft\nMicrosoft addresses this vulnerability with the update listed in Microsoft Security Bulletin  MS07-004.","workarounds":"Disable VML support Microsoft Security Bulletin  MS07-004 suggests the following techniques to disable VML support: Un-register Vgx.dll on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1\nModify the Access Control List on Vgx.dll to be more restrictive\nConfigure Internet Explorer 6 for Microsoft Windows XP Service Pack 2 to disable Binary and Script Behaviors in the Internet and Local Intranet security zone\nDo not follow unsolicited links In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting. Disable Active Scripting Although this vulnerability does not require Active Scripting to be enabled, known exploits targeting this issue use Active Scripting to place malicious code on a vulnerable system. To block this attack vector, it is recommended that Active Scripting be disabled. For instructions on how to disable Active Scripting in Microsoft Internet Explorer, please refer to the Internet Explorer section of the Securing Your Web Browser document. Read and send email in plain text format An attacker may be able to exploit this vulnerability by convincing a user to open a specially crafted HTML email. Only reading email in plaintext will prevent exploitation of this vulnerability through email. Consider the security of fellow Internet users and send email in plain text format when possible. If you use Microsoft Outlook, we encourage you to apply the Outlook Email Security Update. The update configures Outlook to open email messages in the Restricted Sites Zone, where Active scripting is disabled by default. In addition, the update provides further protection against malicious code that attempts to propagate via Outlook. The Outlook Email Security Update is available for Outlook 98 and Outlook 2000. The functionality of the Outlook Email Security Update is included in Outlook 2002 and Outlook Express 6. Outlook 2003 includes these and other security enhancements. Configure Windows Explorer to use Windows Classic Folders When Windows Explorer is configured to use the \"Show common tasks in folders\" option, HTML within a file may be processed when that file is selected. If the \"Show common tasks in folders\" is enabled, selecting a specially crafted HTML document in Windows Explorer may trigger this vulnerability. Note that the \"Show common tasks in folders\" is enabled by default. To mitigate this attack vector, enable the \"Use Windows classic folders\" option. To enable this option in Windows Explorer: Open Windows Explorer\nSelect Folder Options from the Tools menu\nSelect the \"Use Windows classic folders\" option in the Tasks section","sysaffected":"","thanks":"Thanks to Microsoft for reporting this vulnerability, who in turn credit Joseph Moti, working with the iDEFENSE Contributor Program.","author":"This document was written by Will Dormann.","public":["http://www.microsoft.com/technet/security/Bulletin/MS07-004.mspx","http://msdn.microsoft.com/workshop/author/vml/SHAPE/introduction.asp","http://securitytracker.com/alerts/2007/Jan/1017489.html","http://secunia.com/advisories/23677/","http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=462","http://www.ciac.org/ciac/bulletins/r-103.shtml","http://www.securityfocus.com/bid/21930"],"cveids":["CVE-2007-0024"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2007-01-09T18:26:19Z","publicdate":"2007-01-09T00:00:00Z","datefirstpublished":"2007-01-09T18:44:28Z","dateupdated":"2007-01-18T17:52:55Z","revision":12,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"15","cam_exploitation":"15","cam_internetinfrastructure":"5","cam_population":"20","cam_impact":"17","cam_easeofexploitation":"15","cam_attackeraccessrequired":"18","cam_scorecurrent":"60.24375","cam_scorecurrentwidelyknown":"68.85","cam_scorecurrentwidelyknownexploited":"77.45625","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":60.24375,"vulnote":null}