Microsoft Internet Explorer DHTML Engine Race Condition Vulnerability

iDEFENSE Security Advisory 04.12.05
www.idefense.com/application/poi/display?id=228&type=vulnerabilities
April 12, 2005

I. BACKGROUND

Internet Explorer is a set of core technologies in Microsoft Windows
operating systems that provide web browsing functionality. Further
information is available at:

   http://www.microsoft.com/ie/.

Dynamic HTML (DHTML) is built on an object model that extends the 
traditional static HTML document to enable web authors to create more 
engaging and interactive Web pages. DHTML provides authors with enhanced

creative control so they can manipulate any page element at any time. 
More information is available at:

   http://www.microsoft.com/windows/ie
   http://msdn.microsoft.com/workshop/author/dhtml/dhtml_node_entry.asp

II. DESCRIPTION

Remote exploitation of a race condition vulnerability in version 6 of 
Microsoft Corporation's Internet Explorer web browser could allow the 
execution of arbitrary code under the privileges of the currently logged

in user.

Internet Explorer supports dynamic creation of HTML elements with 
JavaScript using various DHTML methods such as createElement(), 
appendChild(), and removeNode(). A number of problems have been found in

the implementation of these objects and methods, including some which 
can be exploited to cause execution of arbitrary code.

The problem specifically exists within the memory management routines of

Internet Explorer's object handling code. In some situations one thread 
reads data from memory that has either been overwritten by another 
thread or has not yet been initialized by another thread. This can lead 
to random crashes and remote command execution.

III. ANALYSIS

Successful exploitation allows remote attackers to execute arbitrary 
code in the context of the user running the Internet Explorer process. 
Exploitation will not be 100% reliable. However, proof of concept
exploit code was generated with reliable execution approximately 90% of
the time.

In order to exploit this vulnerability an attacker must convince the
victim to visit a web site, or cause malicious DHTML code to be rendered
by Internet Explorer using some other technique, such as a persist ant 
XSS (cross-site scripting) attack on a trusted site.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in the 
following Microsoft Internet Explorer versions:

    6.0.2900.2180 on Windows XP Professional with Service Pack 2.
    6.0.2800.1106 on Windows XP Professional with Service Pack 1.
    6.0.2800.1106 on Windows 2000 Professional with Service Pack 4.

It is suspected that all versions of Internet Explorer 6.0 are affected.

V. WORKAROUND

Disable active scripting, if it is not necessary for daily operations,
using the following steps:

1. In IE, click on Tools and select Internet Options from the drop-down
   menu.
2. Click the Security tab and the Custom Level button.
3. Under Scripting, then Active Scripting, click the Disable radio 
   button.

VI. VENDOR RESPONSE

This vulnerability is addressed in Microsoft Security Bulletin MS05-020
available at:

http://www.microsoft.com/technet/security/Bulletin/MS05-020.mspx

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2005-0553 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

10/25/2004  Initial vendor notification
10/25/2004  Initial vendor response
04/12/2005  Coordinated public disclosure

IX. CREDIT

Berend-Jan Wever (skylined[at]edup.tudelft.nl,
http://www.edup.tudelft.nl/~bjwever/) is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES

Copyright (c) 2005 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.