CVE:CVE-2004-0216
CNNVD:CNNVD-200411-024
Microsoft Internet Explorer（IE）是美国微软（Microsoft）公司的一款Windows操作系统附带的Web浏览器。
Microsoft Internet Explorer是一款流行的WEB浏览器。Microsoft Internet Explorer的inseng.dll存在缓冲区溢出问题，远程攻击者可以利用这个漏洞以IE进程权限在系统上执行任意指令。所有Microsoft windows包含Microsoft Active Setup/Install引擎组件，这些组件被标记安全并默认可从任何WEB页调用。当调用由Active Setup控件ActiveX组件'asctrls.ocx'提供的SetCifFile()方法时，如果第一个参数(.cab文件名)字符串长度超过2kb，那么当计算缓冲区空间以允许拷贝'base url'时可发生整数溢出。问题代码存在于Active Setup控件提供的安装引擎控件模块('inseng.dll')中，相关代码如下：MOV EBX，DWORD PTR DS:[<&KERNEL32.lstrcpynA>]     ;  kernel32.lstrcpynA()    ...PUSH DWORD PTR SS:[EBP+C]                ; /String = Cab file nameAND BYTE PTR DS:[ESI]，0                  ; |CALL DWORD PTR DS:[<&KERNEL32.lstrlenA>] ; lstrlenA()MOV ECX，822        ; Max buffer sizeSUB ECX，EAX        ; Calculate remaining buffer space - integer overflow!PUSH ECX                  ; /n = Unchecked value - remaining buffer space!PUSH DWORD PTR SS:[EBP-8] ; |String2 = BaseURL property valuePUSH ESI                  ; |String1 = 0x822 bytes heap bufferCALL EBX                  ; lstrcpynA()MOV EDI，DWORD PTR DS:[<&KERNEL32.lstrcatA>] ;    kernel32.lstrcatA()PUSH inseng.66561C84         ; /StringToAdd = "/"PUSH ESI                     ; |ConcatString = Our heap bufferCALL EDI                     ; lstrcatA()PUSH DWORD PTR SS:[EBP+C]    ; /StringToAdd = Our Cab file namePUSH ESI                     ; |ConcatString = Our heap bufferCALL EDI                     ; lstrcatA()
solution:Upgrade microsoft ie to a higher version than 6:windows_server_2003_sp1,and avoid the version 6:windows_server_2003_sp1; Upgrade microsoft internet_explorer to a higher version than 5.01,5.5,and avoid the version 5.01,5.5