CVE:CVE-2003-0469
CNNVD:CNNVD-200308-019
Microsoft Internet Explorer是一款流行的WEB浏览程序。
Microsoft Internet Explorer对'HR'标记的'Align'值缺少充分检查，远程攻击者可以利用这个漏洞对IE进行拒绝服务攻击，可能以用户权限在系统上执行任意指令。
问题存在于HTML32.cnv程序，是HTML转换程序，攻击者如果构建'HR'标记的'Align'值包含超长字符串的页面，由于此DLL程序没有对'Align'值进行正确的缓冲区边界检查，可导致触发缓冲区溢出，可以控制EBP、EIP等寄存器，精心提交字符串数据可能以用户权限在系统上执行任意指令。
solution:Upgrade microsoft windows_2000 to a higher version than *; Upgrade microsoft windows_2003_server to a higher version than 64-bit,r2,and avoid the version 64-bit,r2; Upgrade microsoft windows_98 to a higher version than *:gold,and avoid the version *:gold; Upgrade microsoft windows_98se to a higher version than *; Upgrade microsoft windows_me to a higher version than *; Upgrade microsoft windows_nt to a higher version than 4.0,and avoid the version 4.0; Upgrade microsoft windows_xp to a higher version than *,*:gold,and avoid the version *:gold