PT-2008-2683 · Microsoft · Internet Explorer

Carsten Eiram · Publicado 2008-04-08 · Atualizado 2018-10-12 · CVE-2008-1085

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4 through 7

Description A use-after-free issue allows remote attackers to execute arbitrary code via a crafted data stream that triggers memory corruption. This can be achieved by constructing a specially crafted Web page that exploits the way Internet Explorer processes data streams. If successfully exploited, an attacker could gain the same user rights as the logged on user.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 through 7, consider restricting access to untrusted web pages until a fix is available. As a temporary workaround, avoid using Internet Explorer to view potentially malicious web content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-1085

Produtos afetados

Internet Explorer

Referências · 13

• http://us-cert.gov/cas/techalerts/TA08-099A.html · Nota
• http://vupen.com/english/advisories/2008/1148/references · Nota
• http://secunia.com/advisories/27707 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=120845064910729&w=2 · Aviso do Fabricante
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-024 · Nota
• http://securitytracker.com/id?1019801 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1085 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2008-1085 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5563 · Nota
• http://securityfocus.com/bid/28552 · Nota
• http://securityfocus.com/archive/1/490840/100/0/threaded · Nota
• http://secunia.com/secunia_research/2007-100/advisory · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-024 · Aviso do Fabricante