PT-2015-5427 · Microsoft · Internet Explorer+2

Publicado 2015-05-12 · Atualizado 2018-10-12 · CVE-2015-1686

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft VBScript versions 5.6 through 5.8 Microsoft JScript versions 5.6 through 5.8

Description A security feature bypass exists in the JScript and VBScript engines, allowing attackers to bypass the Address Space Layout Randomization (ASLR) protection mechanism. This bypass does not allow arbitrary code execution on its own but can be used in conjunction with another vulnerability, such as a remote code execution vulnerability, to more reliably run arbitrary code on a target system.

Recommendations For Microsoft VBScript versions 5.6 through 5.8, consider disabling the use of these engines until a patch is available. For Microsoft JScript versions 5.6 through 5.8, restrict access to the JScript engine to minimize the risk of exploitation. As a temporary workaround, consider disabling the execution of scripts in Internet Explorer 8 through 11 to prevent potential attacks.

Correção

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-1686

Produtos afetados

Internet Explorer

Jscript

Vbscript

Referências · 7

• http://technet.microsoft.com/security/bulletin/ms15-043 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1686 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-053 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-043 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-1686 · Nota de Segurança
• http://securitytracker.com/id/1032282 · Nota
• http://securityfocus.com/bid/74530 · Nota