PT-2008-5541 · Microsoft · Internet Explorer

Carlo Di Dato + 1 · Publicado 2008-12-10 · Atualizado 2023-12-07 · CVE-2008-4258

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 5.01 SP4 through 6 SP1

Description: A remote code execution issue exists due to improper validation of parameters during calls to navigation methods. This allows attackers to execute arbitrary code via a crafted HTML document, triggering memory corruption. An attacker could exploit this by constructing a specially crafted Web page, potentially gaining the same user rights as the logged-on user when a user views the Web page.

Recommendations: For Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1, consider disabling navigation methods until a patch is available. Restrict access to specially crafted Web pages to minimize the risk of exploitation. Avoid using Internet Explorer to view untrusted Web pages until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-4258

Produtos afetados

Internet Explorer

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-4258 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4258 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-073 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5231 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-073 · Nota
• http://vupen.com/english/advisories/2008/3385 · Nota
• http://us-cert.gov/cas/techalerts/TA08-344A.html · Nota
• http://securitytracker.com/id?1021371 · Nota