PT-2013-3142 · Microsoft · Internet Explorer

Published 2013-01-29 · Updated 2013-01-30 · CVE-2013-1450

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 8 and 9

Description The issue allows remote attackers to obtain sensitive information intended for a specific host via a crafted HTML document. This is achieved by triggering many HTTPS requests and then an HTTP request to the target host, potentially reading a Cookie header.

Recommendations For Microsoft Internet Explorer versions 8 and 9, consider configuring the Proxy Settings to use different Proxy address and Port values in the HTTP and Secure rows as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2013-1450

Affected Products

Internet Explorer

References · 4

• 🔥 http://youtube.com/ChristianHaiderPoC · Exploit
• 🔥 http://pastebin.com/raw.php?i=rz9BcBey · Exploit
• 🔥 http://youtube.com/watch?v=TPqagWAvo8U · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1450 · Security Note