PT-2013-3143 · Microsoft · Internet Explorer

Publicado 2013-01-29 · Atualizado 2013-01-30 · CVE-2013-1451

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 8 and 9

Description The issue allows remote attackers to spoof web sites via a crafted HTML document. This is achieved by triggering many HTTPS requests to an arbitrary host, followed by an HTTPS request to a trusted host and then an HTTP request to an untrusted host. The problem arises when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, causing inconsistency in the SSL lock icon with the Address bar.

Recommendations For Microsoft Internet Explorer versions 8 and 9, consider configuring the Proxy Settings to have distinct Proxy address and Port values in the HTTP and Secure rows to minimize the risk of exploitation. As a temporary workaround, users should be cautious of the SSL lock icon consistency with the Address bar when browsing websites.

Exploit

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2013-1451

Produtos afetados

Internet Explorer

Referências · 5

• 🔥 http://youtube.com/ChristianHaiderPoC · Exploit
• 🔥 https://exploit-db.com/exploits/24432 · Exploit
• 🔥 http://pastebin.com/raw.php?i=rz9BcBey · Exploit
• 🔥 http://youtube.com/watch?v=TPqagWAvo8U · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1451 · Nota de Segurança