PT-2010-5204 · Microsoft · Internet Explorer
D0C_S4Vage
+1
·
Publicado
2010-12-22
·
Atualizado
2021-07-23
·
CVE-2010-3971
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Internet Explorer versions 6 through 8
Description
A use-after-free issue in the CSS parser allows remote attackers to execute arbitrary code or cause a denial of service via a self-referential @import rule in a stylesheet. This vulnerability can be exploited by constructing a specially crafted Web page, potentially allowing an attacker to gain the same user rights as the logged-on user. If the user has administrative rights, the attacker could take complete control of the system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Internet Explorer versions 6 through 8, consider disabling the CSS parser or restricting the use of self-referential @import rules in stylesheets as a temporary workaround until a patch is available. Restrict access to specially crafted Web pages to minimize the risk of exploitation.
Exploit
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Internet Explorer