PT-2010-5197 · Microsoft · Internet Explorer

Jose Antonio Vazquez Gonzalez · Publicado 2010-11-05 · Atualizado 2025-10-07 · CVE-2010-3962

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 8

Description The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code. This can be achieved through vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute. An attacker could exploit this by convincing a user to open a malicious document, potentially leading to remote code execution when the document is closed. If successfully exploited, an attacker could gain the same user rights as the logged-on user, and if the user has administrative rights, the attacker could take complete control of the system.

Recommendations For Microsoft Internet Explorer versions 6 through 8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2010-3962

Produtos afetados

Internet Explorer

Referências · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb · Exploit
• 🔥 http://exploit-db.com/exploits/15418 · Exploit
• 🔥 https://exploit-db.com/exploits/16551 · Exploit
• 🔥 https://exploit-db.com/exploits/15418 · Exploit
• 🔥 http://exploit-db.com/exploits/15421 · Exploit
• 🔥 https://exploit-db.com/exploits/15421 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3962 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA10-348A.html · Nota
• http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx · Aviso do Fabricante
• http://securityfocus.com/bid/44536 · Nota
• https://t.me/purp_sec/1184 · Publicação no Telegram
• https://t.me/cveNotify/137537 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62962 · Nota
• http://securitytracker.com/id?1024676 · Nota
• http://secunia.com/advisories/42091 · Aviso do Fabricante