Alert GCSA-06098 - Aggiornamento cumulativo per Microsoft Internet

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

    Alert ID : GCSA-06098
        Data : 15 Novembre 2006
      Titolo : Aggiornamento cumulativo per Microsoft Internet Explorer (MS06-067)(922760)

******************************************************************


:: Descrizione del problema:

    Nel browser Microsoft Internet Explorer
    sono state individuate le seguenti vulnerabilita' remote:

    CVE-2006-4777 - Heap-based buffer overflow in DirectAnimation.Path Control COM object (daxctle.ocx)
    CVE-2006-4446 - Heap-based buffer overflow in DirectAnimation.Path Control COM object (daxctle.ocx)
    CVE-2006-4687 - HTML Rendering Memory Corruption Vulnerability

    Per riuscire a sfruttarle un aggressore deve indurre l'utente a visitare un
    sito Web contenente pagine appositamente predisposte in grado di consentire
    l'esecuzione di codice in modalita' remota.

    Avvertenza: L'articolo della Microsoft Knowledge Base 922760 descrive
    i problemi che si potrebbero incontrare installando l'aggiornamento
    e le relative soluzioni.

    http://support.microsoft.com/?kbid=922760


:: Software interessato:

    MS Windows 2000 SP4
    MS Windows XP SP2
    MS Windows XP Professional x64 Edition
    MS Windows Server 2003 e MS Windows Server 2003 SP1
    MS Windows Server 2003 per sistemi basati su Itanium
    MS Windows Server 2003 con SP1 per sistemi basati su Itanium
    MS Windows Server 2003 x64 Edition

    Internet Explorer 5.01 SP4
    Internet Explorer 6 SP1
    Internet Explorer 6


:: Impatto:

    Un utente malintenzionato che sfrutti queste vulnerabilita' puo' assumere
    in remoto il controllo completo della workstation client.


:: Soluzioni:

    Scaricare ed applicare la patch elencata nel seguente bollettino Microsoft,
    oppure utilizzare uno degli strumenti di aggiornamento Microsoft come
    Aggiornamenti Automatici, Windows Update, Windows Server Update Services,
    Systems Management Server.


:: Riferimenti:

    Microsoft Security Bulletin (MS06-067)(922760)
    http://www.microsoft.com/italy/technet/security/bulletin/ms06-067.mspx

    Microsoft Security Advisory (925444)
    http://www.microsoft.com/technet/security/advisory/925444.mspx

    Microsoft Update
    https://update.microsoft.com/microsoftupdate/

    Mitre's CVE ID:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4777
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4446
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4687

    SecurityFocus Bugtraq ID:
    http://www.securityfocus.com/bid/20047
    http://www.securityfocus.com/bid/19738

    3Com Zero Day Initiative / TippingPoint
    http://www.zerodayinitiative.com/advisories/ZDI-06-041.html

    US-CERT Vulnerability Note
    http://www.kb.cert.org/vuls/id/813588
    http://www.kb.cert.org/vuls/id/377369

    Secunia advisories
    http://secunia.com/advisories/21910/

    FrSIRT
    http://www.frsirt.com/english/advisories/2006/3593
    http://www.frsirt.com/english/advisories/2006/4505

    OSVDB
    http://www.osvdb.org/28842
    http://www.osvdb.org/28841

    ISS X-Force
    http://xforce.iss.net/xforce/xfdb/28942
    http://xforce.iss.net/xforce/xfdb/28608

    Advisory ID: XSec-06-10
    http://www.xsec.org/index.php?module=releases&act=view&type=1&id=19

-----BEGIN PGP SIGNATURE-----

iQCVAwUBRVsk2fOB+SpikaiRAQLOlwP9EM7VypCOhI2yBMxq3Si7J9AVNCX+CHC+
po5gG13m5e82F6ux31u1TNgmt3cPBVFRyxUCDFu0xlsSswOMrdoRAMOTir2aao4R
Fawap8253fGeeFlF/tVIhkIV+mTeKIym/Pu8KthXPo9Iz0+XEjg2Rn8PQJuuuOFB
qRqrxGBAzAc=
=I6b5
-----END PGP SIGNATURE-----