Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: MS06-061: XSLT/MSXML Buffer Overflow Code Execution Vulnerability (moderate) - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
MS06-061: XSLT/MSXML Buffer Overflow Code Execution Vulnerability (moderate)
This vulnerability sounds like a classic parser buffer overflow. The advisory actually includes information regarding two distinct vulnerabilities. But only one of them allows arbitrary code execution.

As with similar vulnerablities, the user has to expose the browser to malicious XML code. This could happen by visiting a compromissed site. Once the browser is exposed to the exploit, it will inherit all the privileges of the user running the browser.

Mitigation steps: SandboxIE, do not  run as administrator and similar steps will help limit the impact of the vulnerability. This vulnerability is first of all a client issue, less a server issue. You could also try the "Internet Explorer Enhanced Security Configuration". However, I find it a bit too strict most of the time (e.g. no Javascript).


I will be teaching next: Defending Web Applications Security Essentials - SANS Munich July 2019

Johannes

3557 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!