Denial of service vulnerabilities in Internet Explorer

Madrid, June 1, 2006- Several new vulnerabilities have been announced in Internet Explorer 6, which could cause the popular Microsoft browser to crash.
The first of these problems concerns a vulnerability on trying to obtain the value pointed to by a null pointer causing the browser to crash.
When creating an empty applet tag prior to any other HTML tag without closing it, Internet Explorer will have a Null Pointer result and, without closing the tag, will crash.

A second problem has been announced, which occurs when trying to enter an infinite loop. This causes Internet Explorer to close and display an ˝unknown software exception˝. Finally, a denial of service problem has been announced when a frame with certain conditions is created and the user clicks on the frame.

Proofs of concept have been published for all the problems described, and so until publication of the corresponding patches, Oxygen3 advises the use of proactive protection in security solutions, as threats that exploit these errors could emerge rapidly. Proactive technologies (such as TruPrevent(TM) from Panda Software) can detect new threats without having previously identified them.

Oxygen3 24h-365d
by Panda Software

2006-06-01 14:43

Back

IT News: