TSRT-06-09: Microsoft DirectAnimation COM Object Memory Corruption
Vulnerability
http://www.tippingpoint.com/security/advisories/TSRT-06-09.html
August 8, 2006
-- CVE ID:
CVE-2006-3638
-- Affected Vendor:
Microsoft
-- Affected Products:
Internet Explorer 6 All Versions
Internet Explorer 5 SP4
-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since August 8, 2006 by Digital Vaccine protection
filter ID 4593. For further product information on the TippingPoint IPS:
http://www.tippingpoint.com
-- Vulnerability Details:
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of Microsoft Internet Explorer. User
interaction is required to exploit this vulnerability in that the
target must visit a malicious page.
The specific flaw exists in the DirectAnimation.DATuple ActiveX control
when improperly calling the Nth() method. By supplying a positive
integer we can control a data reference calculation that is later used
to control execution. The problem is due to the lack of sanity checking
on the index used during a call to TupleNthBvrImpl::GetTypeInfo() in
danim.dll.
-- Vendor Response:
Microsoft has issued an update to correct this vulnerability. More
details can be found at:
http://www.microsoft.com/technet/security/bulletin/MS06-042.mspx
-- Disclosure Timeline:
2006.04.27 - Vulnerability reported to vendor
2006.08.08 - Digital Vaccine released to TippingPoint customers
2006.08.08 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by Cody Pierce, Tipping Point Security
Research Team.
-- About the TippingPoint Security Research Team (TSRT):
The TippingPoint Security Research Team (TSRT) consists of industry
recognized security researchers that apply their cutting-edge
engineering, reverse engineering and analysis talents in our daily
operations. More information about the team is available at:
http://www.tippingpoint.com/security
The by-product of these efforts fuels the creation of vulnerability
filters that are automatically delivered to our customers' intrusion
prevention systems through the Digital Vaccine(R) service.
