PT-2016-2762 · Microsoft · Internet Explorer

Published 2016-09-13 · Updated 2018-10-12 · CVE-2016-3292

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 10 through 11

Description The issue is related to the mishandling of integrity settings and zone settings in Internet Explorer, allowing remote attackers to bypass a sandbox protection mechanism via a crafted web site. This can lead to an elevation of privilege, which by itself does not allow arbitrary code execution but could enable arbitrary code to be run if combined with other vulnerabilities, such as remote code execution or another elevation of privilege vulnerability.

Recommendations For Microsoft Internet Explorer versions 10 and 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-02164

CVE-2016-3292

ZDI-16-510

Affected Products

Internet Explorer

References · 10

• https://osv.dev/vulnerability/CVE-2016-3292 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3292 · Security Note
• https://bdu.fstec.ru/vul/2016-02164 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3292 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-510 · Security Note
• http://technet.microsoft.com/security/bulletin/MS16-104 · Note
• http://securityfocus.com/bid/92808 · Note
• http://securitytracker.com/id/1036788 · Note
• http://technet.microsoft.com/library/security/MS16-104 · Note