PT-2011-2028 · Microsoft · Windows Server 2008 R2+3

Published 2011-02-09 · Updated 2018-10-30 · CVE-2011-0031

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2008 R2 and Windows 7 with JScript 5.8 and VBScript 5.8 scripting engines

Description The issue concerns the JScript 5.8 and VBScript 5.8 scripting engines in Microsoft Windows, which do not properly load decoded scripts from web pages. This allows remote attackers to trigger memory corruption, potentially leading to the disclosure of sensitive information through a crafted website.

Recommendations For Microsoft Windows Server 2008 R2 and Windows 7 with JScript 5.8 and VBScript 5.8, consider restricting access to web pages that could exploit this issue until a fix is available. As a temporary workaround, consider disabling the JScript 5.8 and VBScript 5.8 scripting engines in Microsoft Windows Server 2008 R2 and Windows 7 to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2011-0031

Affected Products

Jscript 5.8

Vbscript 5.8

Windows 7

Windows Server 2008 R2

References · 9

• http://secunia.com/advisories/43249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0031 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-009 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0322 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64919 · Note
• http://securitytracker.com/id?1025044 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12313 · Note
• http://osvdb.org/70827 · Note
• http://securityfocus.com/bid/46139 · Note