PT-2017-18438 · Microsoft · Windows Server 2016+2

Published 2017-07-11 · Updated 2017-07-14 · CVE-2017-8611

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016

Description A spoofing issue exists due to improper parsing of HTTP content by Microsoft Edge. This could allow an attacker to trick a user into visiting a specially crafted website, which could either spoof content or be used to chain an attack with other vulnerabilities in web services. The user must click a specially crafted URL to exploit this issue.

Recommendations For Microsoft Edge on Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, consider avoiding clicking on suspicious or specially crafted URLs as a temporary workaround until a patch is available. Restrict access to untrusted websites to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-8611

Affected Products

Edge

Windows 10

Windows Server 2016

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-8611 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8611 · Security Note
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8611 · Vendor Advisory
• http://securitytracker.com/id/1038858 · Note
• http://securityfocus.com/bid/99391 · Note