CERT-In Vulnerability Note
CIVN-2005-0060
Microsoft Internet Explorer javaprxy.dll COM Object Vulnerability
Original Issue Date:July 02, 2005
Updated: July 02, 2005
Severity Rating: HIGH
Application Affected
Internet Explorer 5.01 Service Pack 3 on Microsoft Windows 2000 Service Pack 3
Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3
Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4
Internet Explorer 6 Service Pack 1 on Microsoft Windows XP Service Pack
Internet Explorer 6 for Microsoft Windows XP Service Pack 2
Internet Explorer 6 Service Pack 1 for Microsoft Windows XP 64-Bit SP1 Itanium
Internet Explorer 6 for Microsoft Windows Server 2003
Internet Explorer 6 for Microsoft Windows Server 2003 Service Pack 1
Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium-based Systems
Internet Explorer 6 for Microsoft Windows Server 2003 with SP1 for Itanium
Internet Explorer 6 for Microsoft Windows XP 64-Bit Edition Version 2003 Itanium
Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition
Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition
Internet Explorer 5.5 Service Pack 2 on Microsoft Windows Millennium Edition
Internet Explorer 6 Service Pack 1 on Microsoft Windows 98
Internet Explorer 6 Service Pack 1 on Microsoft Windows 98 SE
Internet Explorer 6 Service Pack 1 on Microsoft Windows Millennium Edition
Overview
A vulnerability exists in Microsoft Internet Explorer which could allow remote code execution. An attacker who successfully exploits these vulnerabilities could take complete control of an affected system.
Description
The vulnerability is caused due to the JView Profiler Javaprxy.dll COM object being instantiated as ActiveX control inappropriately by the Internet Explorer. Javaprxy.dll COM object is an interface to a debugger in the Microsoft Java Virtual Machine, Internet Explorer support COM objects via the <object> tag.
This could be exploited by a remote attacker by constructing a malicious Web page and entice users to visit this webpage. An attacker who successfully exploited this vulnerability could run malicious code on local system and take complete control of an affected system.
Workaround
Microsoft has suggested the following workarounds - Set Internet and Local intranet security zone settings to 'High'
- Disable ActiveX controls in IE or make it prompt before running
- Unregistered the Javaprxy.dll COM Object
- Modify the Access Control List on Javaprxy.dll to be more restrictive
- Disable the Javaprxy.dll COM object from running in Internet Explorer
- Restrict access to Javaprxy.dll in Internet Explorer by using a Software Restriction Policy
Solution
Apply the appropriate patches as mentioned in Microsoft Security Bulletin
MS05-037
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/advisory/903144.mspx
http://www.microsoft.com/technet/security/bulletin/MS05-037.mspx
References
Secunia Advisory SA15891
http://secunia.com/advisories/15891/
Sec-Consult
http://www.sec-consult.com/184.html
CVE Name
CAN-2005-2087
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|