PT-2011-4430 · Microsoft · Windows Xp+3

Publicado 2011-12-13 · Atualizado 2019-02-26 · CVE-2011-3397

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP versions SP2 through SP3 Microsoft Server 2003 version SP2

Description A remote code execution issue exists in the Microsoft Time component, allowing attackers to execute arbitrary code via a crafted web site. An attacker could exploit this by constructing a specially crafted Web page, potentially gaining the same user rights as the logged-on user when a user views the page.

Recommendations For Microsoft Windows XP versions SP2 through SP3, consider restricting access to the Microsoft Time component until a fix is available. For Microsoft Server 2003 version SP2, avoid using the affected component in Internet Explorer to minimize the risk of exploitation.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-3397

Produtos afetados

Internet Explorer

Server 2003

Windows Xp

Windows

Referências · 6

• http://us-cert.gov/cas/techalerts/TA11-347A.html · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-090 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14735 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/MS11-090 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3397 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2011-3397 · Nota de Segurança