PT-2008-1733 · Microsoft · Internet Explorer

Hyy · Published 2008-02-12 · Updated 2024-02-03 · CVE-2008-0077

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 SP1 through 7

Description A use-after-free issue allows remote attackers to execute arbitrary code by assigning malformed values to certain properties, such as the by property of an animateMotion SVG element. This can be exploited through a specially crafted Web page, potentially allowing an attacker to gain the same user rights as the logged on user.

Recommendations For Microsoft Internet Explorer versions 6 SP1 through 7, consider disabling the use of SVG elements, specifically the animateMotion element, until a patch is available. Restrict access to Web pages that could potentially exploit this issue to minimize the risk of remote code execution.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2008-0077

Affected Products

Internet Explorer

References · 16

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010 · Vendor Advisory
• http://secunia.com/advisories/28903 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0077 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-0077 · Security Note
• http://marc.info/?l=bugtraq&m=120361015026386&w=2 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0512/references · Vendor Advisory
• http://kb.cert.org/vuls/id/228569 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=661 · Note
• https://t.me/cvenotify/69895 · Telegram Post
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-010 · Note
• http://zerodayinitiative.com/advisories/ZDI-08-006.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5396 · Note
• http://securityfocus.com/archive/1/488048/100/0/threaded · Note
• http://securityfocus.com/bid/27666 · Note
• http://us-cert.gov/cas/techalerts/TA08-043C.html · Note