(MS11-003) Cumulative Security Update for Internet Explorer (2482017)

  Severity: CRITICAL
  CVE Identifier: CVE-2010-3971,CVE-2011-0035,CVE-2011-0036,CVE-2011-0038
  Advisory Date: FEB 15, 2011

  DESCRIPTION

This security update addresses vulnerabilities in Internet Explorer that could allow remote code execution. The exploit works when a user views a specially crafted Web page using Internet Explorer or opens a legitimate HTML file that loads a specially crafted library file. Once successful, an attacker could gain the same user rights as the local user. More specifically, it addresses the vulnerabilities by modifying the way Internet Explorer handles objects in memory and Cascading Style Sheets, as well as the way it loads external libraries.

  TREND MICRO PROTECTION INFORMATION

For information on patches specific to the affected software, please proceed to the Microsoft Web page.


For Trend Micro clients using Trend Micro Deep Security and OfficeScan with Intrusion Defense Firewall (IDF), please refer to the table below for the filter identifier(s) specific to this advisory's vulnerability identifier(s):


Vulnerability ID Identifier & Title IDF First Pattern Version IDF First Pattern Release Version
CVE-2010-3971 1004550 - Microsoft Internet Explorer CSS Parsing Remote Code Execution 11-001 Jan 05, 2011
CVE-2011-0036 1004589 - Uninitialized Memory Corruption Vulnerability 11-005 Feb 09, 2011

  AFFECTED SOFTWARE AND VERSION

  • Internet Explorer 6 Windows XP Service Pack 3
  • Internet Explorer 6 Windows Server 2003 Service Pack 2
  • Internet Explorer 6 Windows XP Professional x64 Edition Service Pack 2
  • Internet Explorer 6 Windows Server 2003 x64 Edition Service Pack 2
  • Internet Explorer 6 Windows Server 2003 with SP2 for Itanium-based Systems
  • Internet Explorer 7 Windows XP Service Pack 3
  • Internet Explorer 7 Windows XP Professional x64 Edition Service Pack 2
  • Internet Explorer 7 Windows Server 2003 Service Pack 2
  • Internet Explorer 7 Windows Server 2003 x64 Edition Service Pack 2
  • Internet Explorer 7 Windows Server 2003 with SP2 for Itanium-based Systems
  • Internet Explorer 7 Windows Vista Service Pack 1 and Windows Vista Service Pack 2
  • Internet Explorer 7 Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
  • Internet Explorer 7 Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
  • Internet Explorer 7 Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
  • Internet Explorer 7 Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
  • Internet Explorer 8 Windows XP Service Pack 3
  • Internet Explorer 8 Windows XP Professional x64 Edition Service Pack 2
  • Internet Explorer 8 Windows Server 2003 Service Pack 2
  • Internet Explorer 8 Windows Server 2003 x64 Edition Service Pack 2
  • Internet Explorer 8 Windows Vista Service Pack 1 and Windows Vista Service Pack 2
  • Internet Explorer 8 Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
  • Internet Explorer 8 Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
  • Internet Explorer 8 Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
  • Internet Explorer 8 Windows 7 for 32-bit Systems
  • Internet Explorer 8 Windows 7 for x64-based Systems
  • Internet Explorer 8 Windows Server 2008 R2 for x64-based Systems
  • Internet Explorer 8 Windows Server 2008 R2 for Itanium-based Systems

Related Malware