PT-2003-1308 · Microsoft · Windows Script Engine For Jscript

Roland Postle · Published 2003-03-21 · Updated 2019-04-30 · CVE-2003-0010

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows Script Engine for JScript (JScript.dll) (affected versions not specified)

Description The issue is related to an integer overflow in the JsArrayFunctionHeapSort function. This allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value, enabling a heap-based buffer overflow attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2003-0010

Affected Products

Windows Script Engine For Jscript

References · 10

• http://securityfocus.com/bid/7146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0010 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-008 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A134 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A200 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=26 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A794 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A795 · Note
• http://marc.info/?l=bugtraq&m=104812108307645&w=2 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0139.html · Note