PT-2017-18438 · Microsoft · Windows Server 2016+2

Publicado 2017-07-11 · Atualizado 2017-07-14 · CVE-2017-8611

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016

Description A spoofing issue exists due to improper parsing of HTTP content by Microsoft Edge. This could allow an attacker to trick a user into visiting a specially crafted website, which could either spoof content or be used to chain an attack with other vulnerabilities in web services. The user must click a specially crafted URL to exploit this issue.

Recommendations For Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, consider avoiding clicking on suspicious or specially crafted URLs as a temporary workaround until a patch is available. Restrict access to untrusted websites to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-8611

Produtos afetados

Edge

Windows 10

Windows Server 2016

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-8611 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8611 · Nota de Segurança
• http://securitytracker.com/id/1038858 · Nota
• http://securityfocus.com/bid/99391 · Nota
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8611 · Aviso do Fabricante