PT-2016-2902 · Microsoft · Windows 7+4

Published 2016-10-11 · Updated 2025-04-07 · CVE-2016-3298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Internet Messaging API in Windows Vista SP2 Internet Messaging API in Windows Server 2008 SP2 and R2 SP1 Internet Messaging API in Windows 7 SP1

Description The issue allows remote attackers to determine the existence of arbitrary files via a crafted web site. An attacker who successfully exploited this could test for the presence of files on disk. For an attack to be successful, an attacker must persuade a user to open a malicious website. This is due to Internet Explorer improperly handling objects in memory.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that properly handles objects in memory to prevent information disclosure. For Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1, restrict access to the API until a patch is available to prevent exploitation. As a temporary workaround, consider restricting user access to malicious websites to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-02333

CVE-2016-3298

Affected Products

Internet Explorer

Windows

Windows 7

Windows Server 2008

Windows Vista

References · 18

• https://bdu.fstec.ru/vul/2016-02333 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3298 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3298 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3298 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-126 · Vendor Advisory
• http://technet.microsoft.com/library/security/MS16-118 · Note
• http://technet.microsoft.com/security/bulletin/MS16-126 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/cvenotify/84996 · Telegram Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3298 · Note
• http://technet.microsoft.com/security/bulletin/MS16-118 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3298 · Note
• http://securityfocus.com/bid/93392 · Note