PT-2012-3343 · Microsoft · Internet Explorer

Published 2012-03-09 · Updated 2021-07-23 · CVE-2012-1545

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 9, and 10 Consumer Preview

Description The issue allows remote attackers to bypass Protected Mode or cause a denial of service due to memory corruption. This can be achieved by leveraging access to a Low integrity process. The vulnerability was demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.

Recommendations For Microsoft Internet Explorer versions 6 through 9, and 10 Consumer Preview, consider applying configuration changes to restrict access to Low integrity processes as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-1545

Affected Products

Internet Explorer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2012-1545 · Security Note
• http://twitter.com/vupen/statuses/177895844828291073 · Note
• http://pwn2own.zerodayinitiative.com/status.html · Note
• http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars · Note
• http://zdnet.com/blog/security/pwn2own-2012-ie-9-hacked-with-two-0day-vulnerabilities/10621 · Note