# MA-256.112010: MyCERT Advisory - Critical Vulnerability in Microsoft Internet Explorer

**Date:** 04 Nov 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-256.112010  
**Advisory ID:** MA-256.112010

---

**1.0 Introduction**
A critical vulnerability (CVE-2010-3962) has been identified in the Microsoft Internet Explorer web browser. The vulnerability, if successfully exploited will cause the application to crash and could potentially allow an attacker to take control of the affected system.
The vulnerability exists due to an invalid flag reference within Internet Explorer. It is possible under certain conditions for the invalid flag reference to be accessed after an object is deleted.
Essentially, an attacker can trick users into clicking on a URL, which has been sent via e-mail, and this will direct the users to a specially crafted web page containing the exploit.
MyCERT is aware that a '0-day' exploit is available on the internet at the time of the publication of this advisory.
**2.0 Impact**
An attacker who successfully exploits this vulnerability will be able to execute codes remotely and gain the same privilege as the user. Unsuccessful attacks may cause denial-of-service (DoS) outcomes.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Microsoft Internet Explorer 6
- Microsoft Internet Explorer 7
- Microsoft Internet Explorer 8
**4.0 RecommendationsAs of the writing of this advisory, Microsoft has not released any security patches for this vulnerability. However, users can use the following steps as a temporary workaround if they need to use Microsoft Internet Explorer:**
> 4.1 Windows users are also advised to enable Data Execution Prevention (DEP) on the Windows
>
> - **For Windows XP**
>
>   - Log in as administrator
>   - Open the Start menu, right-click on My Computer and Choose "Properties" from the context menu
>   - On the "System Properties" window, click the "Advanced" tab
>   - Click settings button under Performance
>   - Click the "Data Execution Prevention" tab
>   - Choose "Turn on DEP for all programs and services except those I select:"
>   - Click OK twice
>   - Restart the computer for the changes to take effect
> - **Windows Vista**
>
>   - Log in as administrator
>   - Open the Start menu and right-click "Computer"
>   - Choose "Properties" from the context menu.
>   - Choose "Advanced system settings" from under "Tasks" in the left pane.
>   - Approve the User Account Control query (You will have to be an administrator to do it).
>   - Click the button "Settings" in the Performance section.
>   - Click the tab "Data Execution Prevention"
>   - Choose "Turn on DEP for all programs and services except those I select:"
>   - Click OK twice
>   - Restart the computer for the changes to take effect
>
> 4.2 Disable Active Script support in the browser. Active Script can be disabled by referring to the following steps:
>
> - On the Tools menu, click Internet Options
> - Click the Security tab, choose Internet zone and click on Custom Level
> - Disable the Active Scripting and click OK
>
> 4.3 As for the enterprise environment, deploying the Enhanced Mitigation Experience Toolkit is advised.
>
> - Enhanced Mitigation Experience Toolkit (EMET) is a utility that helps prevent vulnerabilities in software from successfully being exploited by applying in-box mitigations such as DEP to applications configured in EMET. For more information, see <http://support.microsoft.com/kb/2458544>
> - Configure your EMET to protect either
>   C:\program files\Internet Explorer\iexplore.exe
>   C:\Program Files (x86)\Internet Explorer\iexplore.exe
>
> 4.4 Do not browse to untrusted websites or click on untrusted links especially URLs enclosed in e-mails from an unknown sender.
>
> 4.5 Browse the Internet through access of a lower privilege user to minimize the impact of the malicious file.
>
> 4.6 Consider using alternative web browsers to browse the Internet. Please make sure you use the latest version and stay up-to-date as well.
MyCERT would like to advise the users of Microsoft Internet Explorer to be vigilant of the latest security announcements by Microsoft and ensure that they automatically update the operating systems. The article on how to enable the auto update feature in Microsoft is available at the following URL:
[https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
<http://secunia.com/vulnerability_scanning/personal/>
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#ea8793898f989eaa8793898f989ec485988dc48793)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i.<http://www.microsoft.com/technet/security/advisory/2458511.mspx>
ii.<http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks>
iii.<http://support.microsoft.com/kb/2458544>
iv.<http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx>
v.<http://isc.sans.edu/diary.html?storyid=9874>