Reported December 1, 2004, by
Microsoft
VERSIONS AFFECTED
- Microsoft Windows NT
Server 4.0 Service Pack 6a
- Microsoft Windows NT
Server 4.0 Terminal Server Edition Service Pack 6
- Microsoft Windows 2000
Service Pack 3 and Microsoft Windows 2000 Service Pack 4
- Microsoft Windows XP
Service Pack 1
- Microsoft Windows XP
64-Bit Edition Service Pack 1
- Microsoft Windows 98,
Microsoft Windows 98 Second Edition (SE), and Microsoft Windows
Millennium Edition (Me)
|
DESCRIPTION
A vulnerability exists in Microsoft Internet Explorer (IE) that could result in
the execution of arbitrary code on the vulnerable system. Heap-based buffer
overflow in IE 6.0 allows remote attackers to execute arbitrary code via long
SRC or NAME attributes in IFRAME, FRAME, and EMBED elements.
VENDOR RESPONSE
Microsoft has released Security
Bulletin MS04-040, "Cumulative Security Update for Internet
Explorer (889293)," to address this vulnerability and recommends that
affected users immediately apply the appropriate patch listed in the bulletin.
CREDIT
Discovered by Microsoft.