PT-2008-1733 · Microsoft · Internet Explorer

Hyy · Publicado 2008-02-12 · Atualizado 2024-02-03 · CVE-2008-0077

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 SP1 through 7

Description A use-after-free issue allows remote attackers to execute arbitrary code by assigning malformed values to certain properties, such as the by property of an animateMotion SVG element. This can be exploited through a specially crafted Web page, potentially allowing an attacker to gain the same user rights as the logged on user.

Recommendations For Microsoft Internet Explorer versions 6 SP1 through 7, consider disabling the use of SVG elements, specifically the animateMotion element, until a patch is available. Restrict access to Web pages that could potentially exploit this issue to minimize the risk of remote code execution.

Correção

RCE

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2008-0077

Produtos afetados

Internet Explorer

Referências · 16

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010 · Aviso do Fabricante
• http://secunia.com/advisories/28903 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0077 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2008-0077 · Nota de Segurança
• http://kb.cert.org/vuls/id/228569 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=661 · Nota
• https://t.me/cvenotify/69895 · Publicação no Telegram
• http://marc.info/?l=bugtraq&m=120361015026386&w=2 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-010 · Nota
• http://zerodayinitiative.com/advisories/ZDI-08-006.html · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5396 · Nota
• http://securityfocus.com/archive/1/488048/100/0/threaded · Nota
• http://securityfocus.com/bid/27666 · Nota
• http://us-cert.gov/cas/techalerts/TA08-043C.html · Nota
• http://vupen.com/english/advisories/2008/0512/references · Aviso do Fabricante