PT-2014-1607 · Microsoft · Internet Explorer+2

Irsdl · Published 2014-02-26 · Updated 2025-03-14 · CVE-2013-7331

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Internet Explorer versions prior to the fixed version Microsoft.XMLDOM ActiveX control in Microsoft Windows versions prior to 8.1

Description The issue allows attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes. This can be demonstrated by a res:// URL. The vulnerability could allow an attacker to detect anti-malware applications in use on a target and use the information to avoid detection. It has been exploited in the wild.

Recommendations For Internet Explorer, update to a version that includes the fix for this issue. For Microsoft Windows 8.1 and earlier, update to a version that includes the fix for this issue or apply relevant security patches. As a temporary workaround, consider restricting access to the Microsoft.XMLDOM ActiveX control until a patch is available. Avoid using the res:// URL in the affected API endpoint until the issue is resolved.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

CWE-310

Related Identifiers

BDU:2015-00526

CVE-2013-7331

Affected Products

Internet Explorer

Windows

Microsoft.Xmldom Activex Control

References · 16

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ms14_052_xmldom.rb · Exploit
• 🔥 https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages · Exploit
• https://bdu.fstec.ru/vul/2015-00526 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7331 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7331 · Security Note
• https://t.me/cvenotify/110684 · Telegram Post
• https://t.me/cvenotify/114869 · Telegram Post
• http://technet.microsoft.com/en-us/security/bulletin/ms14-052 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cvenotify/105046 · Telegram Post
• http://kb.cert.org/vuls/id/539289 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331 · Note
• http://securitytracker.com/id/1030818 · Note