PT-2008-2683 · Microsoft · Internet Explorer

Carsten Eiram · Published 2008-04-08 · Updated 2018-10-12 · CVE-2008-1085

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4 through 7

Description A use-after-free issue allows remote attackers to execute arbitrary code via a crafted data stream that triggers memory corruption. This can be achieved by constructing a specially crafted Web page that exploits the way Internet Explorer processes data streams. If successfully exploited, an attacker could gain the same user rights as the logged on user.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 through 7, consider restricting access to untrusted web pages until a fix is available. As a temporary workaround, avoid using Internet Explorer to view potentially malicious web content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-1085

Affected Products

Internet Explorer

References · 13

• http://secunia.com/advisories/27707 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=120845064910729&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1085 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-1085 · Security Note
• http://secunia.com/secunia_research/2007-100/advisory · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-024 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA08-099A.html · Note
• http://vupen.com/english/advisories/2008/1148/references · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-024 · Note
• http://securitytracker.com/id?1019801 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5563 · Note
• http://securityfocus.com/bid/28552 · Note
• http://securityfocus.com/archive/1/490840/100/0/threaded · Note