Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: InfoSec Handlers Diary Blog - MS06-061: XSLT/MSXML Buffer Overflow Code Execution Vulnerability (moderate) InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

MS06-061: XSLT/MSXML Buffer Overflow Code Execution Vulnerability (moderate)

Published: 2006-10-10
Last Updated: 2006-10-10 18:40:14 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
This vulnerability sounds like a classic parser buffer overflow. The advisory actually includes information regarding two distinct vulnerabilities. But only one of them allows arbitrary code execution.

As with similar vulnerablities, the user has to expose the browser to malicious XML code. This could happen by visiting a compromissed site. Once the browser is exposed to the exploit, it will inherit all the privileges of the user running the browser.

Mitigation steps: SandboxIE, do not  run as administrator and similar steps will help limit the impact of the vulnerability. This vulnerability is first of all a client issue, less a server issue. You could also try the "Internet Explorer Enhanced Security Configuration". However, I find it a bit too strict most of the time (e.g. no Javascript).


Keywords: MSFT1006
0 comment(s)
Diary Archives