PT-2017-1511 · Microsoft · Windows Server 2016+3

Published 2017-03-14 · Updated 2017-07-12 · CVE-2017-0154

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016

Description The issue arises from the failure to enforce cross-domain policies, allowing attackers to access information from one domain and inject it into another via a crafted application. This could enable a remote attacker to obtain and transfer information between domains.

Recommendations For Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016, consider applying configuration changes to enforce cross-domain policies until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2017-00656

CVE-2017-0154

Affected Products

Internet Explorer

Internet Explorer 11

Windows 10

Windows Server 2016

References · 8

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0154 · Security Note
• https://bdu.fstec.ru/vul/2017-00656 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0154 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0154 · Security Note
• http://securitytracker.com/id/1038008 · Note
• http://technet.microsoft.com/library/security/MS17-006 · Note
• http://securityfocus.com/bid/96766 · Note