PT-2014-1059 · Microsoft · Vbscript+1

Published 2014-02-11 · Updated 2018-10-12 · CVE-2014-0271

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Internet Explorer versions 6 through 11 VBScript versions 5.6 through 5.8

Description The issue is related to the handling of objects in memory by the VBScript engine, allowing remote attackers to execute arbitrary code or cause memory corruption via a crafted web site. This could enable an attacker to gain control over an affected system, especially if the current user has administrative rights, potentially leading to the installation of programs, modification or deletion of data, and creation of new accounts with full user rights.

Recommendations For Internet Explorer versions 6 through 11, update to a version that includes the fix for this issue. For VBScript versions 5.6 through 5.8, consider disabling the VBScript engine until a patch is available. As a temporary workaround, restrict access to web sites that could potentially exploit this vulnerability. Avoid using Internet Explorer or VBScript for sensitive operations until the issue is resolved.

Fix

RCE

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2014-00141

CVE-2014-0271

Affected Products

Internet Explorer

Vbscript

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-011 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00141 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0271 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0271 · Security Note
• http://secunia.com/advisories/56814 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-010 · Note
• http://secunia.com/advisories/56796 · Note
• http://osvdb.org/103166 · Note
• http://securitytracker.com/id/1029741 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90757 · Note
• http://securityfocus.com/bid/65395 · Note