PT-2011-2028 · Microsoft · Windows Server 2008 R2+3

Publicado 2011-02-09 · Atualizado 2018-10-30 · CVE-2011-0031

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 and Windows 7 with JScript 5.8 and VBScript 5.8 scripting engines

Description The issue concerns the JScript 5.8 and VBScript 5.8 scripting engines in Microsoft Windows, which do not properly load decoded scripts from web pages. This allows remote attackers to trigger memory corruption, potentially leading to the disclosure of sensitive information through a crafted website.

Recommendations For Microsoft Windows Server 2008 R2 and Windows 7 with JScript 5.8 and VBScript 5.8, consider restricting access to web pages that could exploit this issue until a fix is available. As a temporary workaround, consider disabling the JScript 5.8 and VBScript 5.8 scripting engines in Microsoft Windows Server 2008 R2 and Windows 7 to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2011-0031

Produtos afetados

Jscript 5.8

Vbscript 5.8

Windows 7

Windows Server 2008 R2

Referências · 9

• http://secunia.com/advisories/43249 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0031 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64919 · Nota
• http://securitytracker.com/id?1025044 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12313 · Nota
• http://osvdb.org/70827 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-009 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0322 · Aviso do Fabricante
• http://securityfocus.com/bid/46139 · Nota