PT-2015-7127 · Microsoft · Vbscript+2
Simon Zuckerbraun
·
Publicado
2015-12-08
·
Atualizado
2018-10-12
·
CVE-2015-6135
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft VBScript versions 5.7 and 5.8
Microsoft JScript versions 5.7 and 5.8
Description
The issue allows remote attackers to obtain sensitive information from process memory via a crafted web site. An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user’s computer or data. To exploit the issue, an attacker must know the memory address of where the object was created.
Recommendations
For Microsoft VBScript version 5.7, update to a version that fixes the information disclosure vulnerability.
For Microsoft VBScript version 5.8, update to a version that fixes the information disclosure vulnerability.
For Microsoft JScript version 5.7, update to a version that fixes the information disclosure vulnerability.
For Microsoft JScript version 5.8, update to a version that fixes the information disclosure vulnerability.
As a temporary workaround, consider restricting access to the
CreateObject function until a patch is available.Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Internet Explorer
Jscript
Vbscript