PT-2016-2489 · Microsoft · Edge+1

Publicado 2016-07-12 · Atualizado 2018-10-12 · CVE-2016-3274

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description The issue is related to a spoofing attack that can be conducted via a crafted URL. An attacker could exploit this to trick a user by redirecting them to a specially crafted website, which could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. The problem is associated with inadequate access control and improper parsing of HTTP content by the Microsoft browser.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that properly parses HTTP content to prevent spoofing attacks. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2016-01880

CVE-2016-3274

Produtos afetados

Edge

Internet Explorer

Referências · 11

• https://nvd.nist.gov/vuln/detail/CVE-2016-3274 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085 · Aviso do Fabricante
• http://securityfocus.com/bid/91591 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-084 · Nota
• http://securitytracker.com/id/1036283 · Nota
• https://osv.dev/vulnerability/CVE-2016-3274 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01880 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3274 · Nota de Segurança
• http://technet.microsoft.com/library/security/ms16-084 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-085 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084 · Aviso do Fabricante