PT-2017-1465 · Microsoft · Edge+1

Published 2017-03-14 · Updated 2017-07-12 · CVE-2017-0012

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions (affected versions not specified) Microsoft Internet Explorer versions (affected versions not specified)

Description The issue exists due to insufficient input validation in Microsoft browsers, allowing a remote attacker to bypass certificate validation using a specially crafted website. An attacker could exploit this to trick a user by redirecting them to a specially crafted website, which could spoof content or be used to chain an attack with other vulnerabilities in web services. To exploit this, the user must click a specially crafted URL.

Recommendations For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Internet Explorer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-00605

CVE-2017-0012

Affected Products

Edge

Internet Explorer

References · 9

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0012 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0012 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00605 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0012 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0012 · Security Note
• http://technet.microsoft.com/library/security/MS17-007 · Note
• http://securityfocus.com/bid/96085 · Note
• http://technet.microsoft.com/library/security/MS17-006 · Note
• http://securitytracker.com/id/1038006 · Note