PT-2015-1598 · Microsoft · Internet Explorer

Thomas Vanhoutte · Published 2015-06-09 · Updated 2018-10-12 · CVE-2015-1739

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 10 through 11

Description The issue is related to insufficient access restrictions to certain functions in Internet Explorer, allowing a remote attacker to gain elevated privileges via a crafted web site. This vulnerability can be exploited by running script with elevated privileges under specific conditions, although it does not allow arbitrary code execution on its own. However, it could be used in conjunction with another vulnerability, such as a remote code execution vulnerability, to take advantage of the elevated privileges.

Recommendations For versions 10 and 11, consider restricting access to sensitive functions until a patch is available. As a temporary workaround, consider disabling the execution of scripts with elevated privileges in Internet Explorer until a fix is provided. Restrict the use of Internet Explorer for accessing untrusted web sites to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-10930

CVE-2015-1739

ZDI-15-249

Affected Products

Internet Explorer

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1739 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1739 · Security Note
• https://bdu.fstec.ru/vul/2015-10930 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-249 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-056 · Note
• http://technet.microsoft.com/security/bulletin/MS15-056 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-249 · Note
• http://securitytracker.com/id/1032521 · Note
• http://securityfocus.com/bid/74995 · Note