PT-2008-1734 · Microsoft · Internet Explorer

Published 2008-02-12 · Updated 2018-10-12 · CVE-2008-0078

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01, 6 SP1, 6 SP2, and 7

Description The issue allows remote attackers to execute arbitrary code via a crafted image. A remote code execution vulnerability exists in the way Internet Explorer handles argument validation in image processing. An attacker could exploit the vulnerability by constructing a specially crafted Web page, which could allow remote code execution when a user views the Web page. An attacker who successfully exploited this issue could gain the same user rights as the logged on user.

Recommendations For Microsoft Internet Explorer version 5.01, update to a newer version to mitigate the risk. For Microsoft Internet Explorer version 6 SP1, update to a newer version to mitigate the risk. For Microsoft Internet Explorer version 6 SP2, update to a newer version to mitigate the risk. For Microsoft Internet Explorer version 7, update to a newer version to mitigate the risk.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-0078

Affected Products

Internet Explorer

References · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-010 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=120361015026386&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0078 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-0078 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4904 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-010 · Note
• http://securitytracker.com/id?1019381 · Note
• http://us-cert.gov/cas/techalerts/TA08-043C.html · Note
• http://securityfocus.com/bid/27689 · Note
• http://secunia.com/advisories/28903 · Note
• http://vupen.com/english/advisories/2008/0512/references · Note