VUPEN Vulnerability Research Team discovered a vulnerability in Microsoft Windows. The vulnerability is caused by a use-after-free error in the TIME (datime.dll) module when loaded via a specific behavior, which could be exploited by remote attackers to compromise a vulnerable system via a specially crafted web page.

VUPEN Security Research - Microsoft Windows "datime.dll" Remote Code 
Execution Vulnerability (MS11-090)

Website : http://www.vupen.com/english/research.php

Twitter : http://twitter.com/vupen


I. BACKGROUND
---------------------

Microsoft Windows is a series of software operating systems and graphical
user interfaces produced by Microsoft. Windows had approximately 90% of
the market share of the client operating systems. (Wikipedia)


II. DESCRIPTION
---------------------

VUPEN Vulnerability Research Team discovered a vulnerability in Microsoft
Windows.

The vulnerability is caused by a use-after-free error in the TIME 
(datime.dll)
module when loaded via a specific behavior, which could be exploited by
remote attackers to compromise a vulnerable system via a specially crafted
web page.


III. AFFECTED PRODUCTS
---------------------------

Microsoft Windows XP Service Pack 3
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP2 (Itanium)


IV. Binary Analysis and Exploits/PoCs
---------------------------------------

In-depth binary analysis of the vulnerability and a code execution exploit
are available through the VUPEN Binary Analysis and Exploits portal :

Thnks...