PT-2017-18437 · Microsoft · Windows Server 2012 R2+8

Published 2017-07-11 · Updated 2017-07-14 · CVE-2017-8602

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft browsers on Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016

Description A spoofing issue exists due to improper parsing of HTTP content by affected Microsoft browsers. This could allow an attacker to trick a user into visiting a specially crafted website, potentially leading to content spoofing or serving as a pivot for chaining attacks with other web service vulnerabilities. The user must click a specially crafted URL for the exploit to be successful.

Recommendations To resolve the issue, update Microsoft browsers to a version that properly parses HTTP content. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-8602

Affected Products

Edge

Internet Explorer

Windows 7

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2

Windows Server 2012 R2

Windows Server 2016

References · 7

• https://osv.dev/vulnerability/CVE-2017-8602 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8602 · Security Note
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8602 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8602 · Security Note
• http://securitytracker.com/id/1038859 · Note
• http://securityfocus.com/bid/99390 · Note
• http://securitytracker.com/id/1038860 · Note