CricketMX.com

Microsoft is investigating a newly reported flaw in Internet Explorer 6 that could cause the browser to crash when viewing a malicious Web page, the company said Monday.

Details of the security weakness in the Web browser were published on a popular security mailing list last week by researcher Michal Zalewski. "This might not come as a surprise, but there appears to be a very interesting and apparently very much exploitable overflow in Microsoft Internet Explorer," he wrote.

The flaw can be exploited by an attacker to crash IE, Secunia said in an advisory published Monday. The vulnerability has been confirmed on a fully patched PC running IE 6 and Windows XP with Service Pack 2, the security monitoring company said. Secunia deems the issue "not critical."

Microsoft is investigating the issue, a company representative said in an e-mailed statement. "At this time, we are not aware of any attacks attempting to use the reported vulnerability," the representative wrote.

Once it completes its inquiry, Microsoft said, it may issue a security advisory or provide a patch through its monthly release process.

Secunia Advisory: SA19269
Release Date: 2006-03-20

Critical: Not critical
Impact: DoS

Where: From remote

Solution Status: Unpatched

Software: Microsoft Internet Explorer 6.x

Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.

Description:
Michal Zalewski has discovered a weakness in Internet Explorer, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an array boundary error in the handling of HTML tags with multiple event handlers. This can be exploited to crash a vulnerable browser via a HTML tag with 94 or more event handlers.

The weakness has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2.

Solution:
Do not visit untrusted web sites.

Provided and/or discovered by:
Michal Zalewski