Intrusion Prevention

MS.IE.HTML.Objects.SetExpression.Memory.Corruption

Description

This indicates an attempt to exploit a memory corruption vulnerability in Microsoft Internet Explorer (IE).
This vulnerability is due to inadequate validation of the arguments provided to the "SetExpression()" function. It may allow remote attackers to execute arbitrary code in the context of IE. Failed exploit attempts will likely cause IE to crash, resulting in a denial of service condition.

Affected Products

Internet Explorer 5.01
Internet Explorer 6
Internet Explorer 6 Service Pack 1

Impact

System Compromise: remote attackers can gain control of vulnerable systems.

Recommended Actions

Refer to the vendor's web site for suggested workaround.
http://www.microsoft.com/technet/security/Bulletin/ms08-058.mspx

CVE References

CVE-2008-3476