PT-2016-2762 · Microsoft · Internet Explorer

Publicado 2016-09-13 · Atualizado 2018-10-12 · CVE-2016-3292

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 10 through 11

Description The issue is related to the mishandling of integrity settings and zone settings in Internet Explorer, allowing remote attackers to bypass a sandbox protection mechanism via a crafted web site. This can lead to an elevation of privilege, which by itself does not allow arbitrary code execution but could enable arbitrary code to be run if combined with other vulnerabilities, such as remote code execution or another elevation of privilege vulnerability.

Recommendations For Microsoft Internet Explorer versions 10 and 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-02164

CVE-2016-3292

ZDI-16-510

Produtos afetados

Internet Explorer

Referências · 10

• https://osv.dev/vulnerability/CVE-2016-3292 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3292 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS16-104 · Nota
• http://securityfocus.com/bid/92808 · Nota
• https://bdu.fstec.ru/vul/2016-02164 · Nota de Segurança
• http://securitytracker.com/id/1036788 · Nota
• http://technet.microsoft.com/library/security/MS16-104 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3292 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-16-510 · Nota de Segurança