PT-2015-1061 · Microsoft · Internet Explorer

Publicado 2015-04-14 · Atualizado 2018-10-12 · CVE-2015-1661

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Internet Explorer versions 6 through 11

Description The issue is related to a security feature bypass vulnerability in the Address Space Layout Randomization (ASLR) mechanism. This vulnerability allows an attacker to more reliably predict memory offsets, which could be used in conjunction with another vulnerability to execute arbitrary code. The ASLR bypass by itself does not allow code execution but can be used to increase the reliability of exploiting other vulnerabilities.

Recommendations For Internet Explorer versions 6 through 11, consider disabling the ASLR bypass vulnerability as a temporary workaround until a patch is available. However, since the provided information does not specify a fixed version or a direct patch for this issue, and given the nature of the vulnerability, restricting access to potentially vulnerable web sites or modules could help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-09916

CVE-2015-1661

ZDI-15-127

Produtos afetados

Internet Explorer

Referências · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-032 · Aviso do Fabricante
• http://securityfocus.com/bid/74006 · Nota
• http://securitytracker.com/id/1032108 · Nota
• http://technet.microsoft.com/security/bulletin/ms15-032 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1661 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-09916 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-15-127 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1661 · Nota de Segurança