iDefense Security Advisory 06.12.07 - Remote exploitation of an invalid memory access vulnerability in various Microsoft products, including Internet Explorer, while creating certain COM objects may allow an attacker to execute arbitrary code. When creating certain COM objects in Internet Explorer, memory corruption can occur, which may allow an attacker to execute arbitrary code. When calling the IObjectSafety function, uninitialized memory is accessed in a way that can allow code execution to occur. The IObjectSafety function is used by COM objects to determine if an object is safe to load in a particular context. iDefense confirmed the existence of this vulnerability using Internet Explorer 6 on Windows XP SP2 and Windows Server 2000 SP4. Although Windows Server 2003 contains an affected version, the Enhanced Security Configuration mitigates exposure to this vulnerability. Microsoft reports that Internet Explorer 7 is not affected.
a74c91fe7b6c7714c4365088ca27deb6c403f878d0f025a28834d11a94ec71e2
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed