Software Engineering Institute

DHTML, TextRanges, and the createTextRange Method

According to Microsoft:

Dynamic HTML (DHTML) is built on an object model that extends the traditional static HTML document which enables Web authors to create more engaging and interactive Web pages.
A TextRange is a DHTML object that represents text. createTextRange() is a DHTML method to generate a TextRange for a DHTML Object.

The Problem

IE fails to properly handle the createTextRange() method. When this method is called for certain DHTML objects, memory may be corrupted in a way that could allow an attacker to execute arbitrary code.

More information is available in Microsoft Security Bulletin MS06-013 and Microsoft Security Advisory 917077.

Note that working exploit code is available for this vulnerability.

By convincing a user to open a specially crafted web page, a remote unauthenticated attacker can execute arbitrary code on a vulnerable system.

Apply an Update
This issue is addressed in Microsoft Security Bulletin MS06-013.

Disable Active Scripting

Known attack vectors for this vulnerability require Active Scripting to be enabled. By disabling Active Scripting, the chances of exploitation are reduced. For instructions on how to disable Active Script in Internet Explorer, please refer to the Internet Explorer section of the Securing Your Web Browser document.

Additional workarounds are available in Microsoft Security Advisory 917077.

Read and send email in plain text format

An attacker may be able to exploit this vulnerability by convincing a user to open a specially crafted HTML email. Only reading email in plaintext will prevent exploitation of this vulnerability through email. Consider the security of fellow Internet users and send email in plain text format when possible.

If you use Microsoft Outlook, we encourage you to apply the Outlook Email Security Update. The update configures Outlook to open email messages in the Restricted Sites Zone, where Active scripting is disabled by default. In addition, the update provides further protection against malicious code that attempts to propagate via Outlook. The Outlook Email Security Update is available for Outlook 98 and Outlook 2000. The functionality of the Outlook Email Security Update is included in Outlook 2002 and Outlook Express 6. Outlook 2003 includes these and other security enhancements.

Do not follow unsolicited links

In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.