Microsoft Windows Internet Explorer Long Hostname Heap Corruption
Vulnerability

iDEFENSE Security Advisory 04.12.05
www.idefense.com/application/poi/display?id=229&type=vulnerabilities
April 12, 2005

I. BACKGROUND

Internet Explorer is a set of core technologies in Microsoft Windows
operating systems that provide web browsing functionality. Further
information is available at:

   http://www.microsoft.com/ie/.

II. DESCRIPTION

Remote exploitation of an input validation error in Microsoft Corp.'s
Internet Explorer may allow the execution of arbitrary code.

The vulnerability specifically exists in the handling of long hostnames.
When IE is requested to open a URL with a hostname part longer than
about 256 characters, the heap becomes slightly corrupted. This
corruption may cause no visible effect, or it may cause the Address Bar
to contain a URL with "garbage" characters as the hostname. It may also
cause IE to crash, referencing an invalid memory address. In testing
done, the addresses referred during a crash are at times controllable by
the web page containing the malformed URL.

III. ANALYSIS

Successful exploitation allows remote attackers to execute arbitrary
code under the privileges of the current user.

Although it is not trivial to exploit this vulnerability, it is believed
to be possible. Testing during verification of this vulnerability
revealed multiple situations where remotely supplied values were used to
reference memory locations. A remote attacker may be able to read data
from, write data to, or execute arbitrary code by supplying
specifically malformed content.

IV. DETECTION

iDEFENSE Labs has confirmed that Internet Explorer 6.0.2180 on Windows
XP with Service Pack 2 is vulnerable.

V. WORKAROUND

iDEFENSE is currently unaware of any effective workarounds for this
issue. The vulnerable functionality is a major part of the affected
product, and is it is not possible to disable it.

Although it will not prevent all means of exploitation, disable active
scripting if it is not necessary for day-to-day operations using the
following steps:

    1. In IE, click on Tools and select Internet Options from the
       drop-down menu.
    2. Click the Security tab and the Custom Level button.
    3. Under Scripting, then Active Scripting, click the Disable radio
       button.

VI. VENDOR RESPONSE

This vulnerability is addressed in Microsoft Security Bulletin MS05-020
available at:

http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0554 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

11/11/2004  Initial vendor notification
11/11/2004  Initial vendor response
04/12/2005  Coordinated public disclosure

IX. CREDIT

3APA3A (http://www.security.nnov.ru/) and axle@bytefall are credited
with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.