PT-2017-1465 · Microsoft · Edge+1

Publicado 2017-03-14 · Atualizado 2017-07-12 · CVE-2017-0012

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions (affected versions not specified) Microsoft Internet Explorer versions (affected versions not specified)

Description The issue exists due to insufficient input validation in Microsoft browsers, allowing a remote attacker to bypass certificate validation using a specially crafted website. An attacker could exploit this to trick a user by redirecting them to a specially crafted website, which could spoof content or be used to chain an attack with other vulnerabilities in web services. To exploit this, the user must click a specially crafted URL.

Recommendations For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Internet Explorer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-00605

CVE-2017-0012

Produtos afetados

Edge

Internet Explorer

Referências · 9

• http://technet.microsoft.com/library/security/MS17-007 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0012 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0012 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00605 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-0012 · Nota de Segurança
• http://securityfocus.com/bid/96085 · Nota
• http://technet.microsoft.com/library/security/MS17-006 · Nota
• http://securitytracker.com/id/1038006 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0012 · Nota de Segurança