PT-2012-3343 · Microsoft · Internet Explorer

Publicado 2012-03-09 · Atualizado 2021-07-23 · CVE-2012-1545

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 9, and 10 Consumer Preview

Description The issue allows remote attackers to bypass Protected Mode or cause a denial of service due to memory corruption. This can be achieved by leveraging access to a Low integrity process. The vulnerability was demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

Recommendations For Microsoft Internet Explorer versions 6 through 9, and 10 Consumer Preview, consider applying configuration changes to restrict access to Low integrity processes as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-1545

Produtos afetados

Internet Explorer

Referências · 5

• http://twitter.com/vupen/statuses/177895844828291073 · Nota
• http://pwn2own.zerodayinitiative.com/status.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1545 · Nota de Segurança
• http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars · Nota
• http://zdnet.com/blog/security/pwn2own-2012-ie-9-hacked-with-two-0day-vulnerabilities/10621 · Nota