PT-2017-2551 · Microsoft · Windows Rt 8.1+3

Ivan Fratric · Published 2017-07-11 · Updated 2019-03-26 · CVE-2017-8594

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Internet Explorer versions on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2

Description The issue is caused by a memory corruption vulnerability in Internet Explorer, allowing a remote attacker to execute arbitrary code in the context of the current user. This occurs when Internet Explorer improperly accesses objects in memory, potentially corrupting memory and enabling the execution of arbitrary code. If the current user has administrative rights, the attacker could gain control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2, consider restricting access to sensitive data and minimizing the use of administrative user rights until a fix is available. As a temporary workaround, avoid using Internet Explorer for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-01762

CVE-2017-8594

Affected Products

Internet Explorer

Windows 8.1

Windows Rt 8.1

Windows Server 2012 R2

References · 7

• 🔥 https://exploit-db.com/exploits/42336 · Exploit
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8594 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8594 · Security Note
• https://bdu.fstec.ru/vul/2017-01762 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-8594 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8594 · Vendor Advisory
• http://securityfocus.com/bid/99401 · Note