Vulnerabilities > CVE-2008-3476 - Resource Management Errors vulnerability in Microsoft Internet Explorer 5.01/6/7
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Objects Memory Corruption Vulnerability."
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 4 | |
OS | 15 |
Common Weakness Enumeration (CWE)
Nessus
NASL family | Windows : Microsoft Bulletins |
NASL id | SMB_NT_MS08-058.NASL |
description | The remote host is missing the IE cumulative security update 956390. The remote version of IE is vulnerable to several flaws that could allow an attacker to execute arbitrary code on the remote host. |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 34403 |
published | 2008-10-15 |
reporter | This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. |
source | https://www.tenable.com/plugins/nessus/34403 |
title | MS08-058: Microsoft Internet Explorer Multiple Vulnerabilities (956390) |
code |
|
Oval
accepted | 2011-12-05T04:00:18.516-05:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
description | Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Objects Memory Corruption Vulnerability." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
id | oval:org.mitre.oval:def:13344 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
submitted | 2011-10-25T13:27:14 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
title | HTML Objects Memory Corruption Vulnerability in Internet Explorer | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
version | 71 |
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 31615,31616,31654,31618 CVE(CAN) ID: CVE-2008-3472,CVE-2008-3473,CVE-2008-3474,CVE-2008-3476 Internet Explorer是Windows操作系统中捆绑的非常流行的WEB浏览器。 Internet Explorer中的多个安全漏洞可能允许恶意攻击者执行跨站脚本攻击,完全入侵用户的系统。 1) 处理某些HTML元素或事件时的漏洞可能导致Internet Explorer错误的解释脚本来源,导致以其他域或安全区的环境执行脚本代码,或允许脚本访问另一个域或Internet Explorer区域中的浏览器窗口。 2) 在特定情形下尝试访问未初始化的内存允许在Internet Explorer中执行代码。 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.0.1 SP4 临时解决方法: * 将Internet Explorer配置为在Internet和本地Intranet安全区域中运行ActiveX控件之前进行提示。 * 将Internet 和本地Intranet安全区域设置设为“高”,以便在这些区域中运行ActiveX控件和活动脚本之前进行提示。 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(MS08-058)以及相应补丁: MS08-058:Cumulative Security Update for Internet Explorer (956390) 链接:<a href=http://www.microsoft.com/technet/security/Bulletin/MS08-058.mspx?pf=true target=_blank>http://www.microsoft.com/technet/security/Bulletin/MS08-058.mspx?pf=true</a> |
id | SSV:4267 |
last seen | 2017-11-19 |
modified | 2008-10-22 |
published | 2008-10-22 |
reporter | Root |
title | Microsoft IE多个跨域信息泄露和内存破坏漏洞(MS08-058) |
References
- http://www.securityfocus.com/bid/31618
- http://www.securitytracker.com/id?1021047
- http://marc.info/?l=bugtraq&m=122479227205998&w=2
- http://www.us-cert.gov/cas/techalerts/TA08-288A.html
- http://www.vupen.com/english/advisories/2008/2809
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45565
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45564
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13344
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058