PT-2016-2744 · Microsoft · Internet Explorer

Eduardo Braun Prado · Published 2016-09-13 · Updated 2024-01-30 · CVE-2016-3353

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Internet Explorer versions 9 through 11

Description The issue is related to how Internet Explorer handles files with the .url extension from the Internet zone, allowing a remote attacker to bypass access restrictions using a specially crafted file. This can enable the attacker to circumvent existing security measures.

Recommendations For Internet Explorer versions 9 through 11, consider restricting the handling of .url files from the Internet zone as a temporary mitigation measure until a patch is available.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2016-02146

CVE-2016-3353

ZDI-16-506

Affected Products

Internet Explorer

References · 13

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3353 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-3353 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3353 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-16-506 · Security Note
• https://bdu.fstec.ru/vul/2016-02146 · Security Note
• http://securityfocus.com/bid/92827 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-506 · Note
• http://technet.microsoft.com/security/bulletin/MS16-104 · Note
• https://t.me/aptreports/7623 · Telegram Post
• http://technet.microsoft.com/library/security/MS16-104 · Note
• https://twitter.com/InQuest/status/1748037281531793842 · Twitter Post
• http://securitytracker.com/id/1036788 · Note