PT-2013-1966 · Microsoft · Internet Explorer

Publicado 2013-01-22 · Atualizado 2013-09-03 · CVE-2012-6502

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions prior to 10

Description The issue allows remote attackers to obtain sensitive information about the existence of files and read certain data from files via a UNC share pathname in the SRC attribute of a SCRIPT element. This can be demonstrated by reading a name-value pair from a local file via a 127.0.0.1C$ sequence.

Recommendations For versions prior to 10, update to version 10 or later to resolve the issue. As a temporary workaround, consider restricting access to the SRC attribute of the SCRIPT element to minimize the risk of exploitation. Avoid using the UNC share pathname in the SRC attribute until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-6502

Produtos afetados

Internet Explorer

Referências · 2

• http://nsfocus.com/en/2012/advisories_1228/119.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6502 · Nota de Segurança