Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE Published: 2011-04-13
Updated: 2022-02-28
Summary
Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obtain sensitive information or conduct clickjacking attacks via a crafted web site, aka "Frame Tag Information Disclosure Vulnerability."
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Msbulletin
bulletin_id | MS11-018 |
bulletin_url | |
date | 2011-04-12T00:00:00 |
impact | Remote Code Execution |
knowledgebase_id | 2497640 |
knowledgebase_url | |
severity | Critical |
title | Cumulative Security Update for Internet Explorer |
Nessus
NASL family | Windows : Microsoft Bulletins |
NASL id | SMB_NT_MS11-018.NASL |
description | The remote host is missing Internet Explorer (IE) Security Update 2497640. The installed version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host. |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 53375 |
published | 2011-04-13 |
reporter | This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. |
source | https://www.tenable.com/plugins/nessus/53375 |
title | MS11-018: Cumulative Security Update for Internet Explorer (2497640) |
Oval
accepted | 2014-08-18T04:00:13.343-04:00 |
class | vulnerability |
contributors | name | Dragos Prisaca | organization | Symantec Corporation |
name | Dragos Prisaca | organization | Symantec Corporation |
name | Maria Mikhno | organization | ALTX-SOFT |
name | Maria Mikhno | organization | ALTX-SOFT |
|
definition_extensions | comment | Microsoft Windows XP (32-bit) is installed | oval | oval:org.mitre.oval:def:1353 |
comment | Microsoft Internet Explorer 6 is installed | oval | oval:org.mitre.oval:def:563 |
comment | Microsoft Windows XP x64 is installed | oval | oval:org.mitre.oval:def:15247 |
comment | Microsoft Windows Server 2003 (32-bit) is installed | oval | oval:org.mitre.oval:def:1870 |
comment | Microsoft Windows Server 2003 (x64) is installed | oval | oval:org.mitre.oval:def:730 |
comment | Microsoft Windows Server 2003 (ia64) Gold is installed | oval | oval:org.mitre.oval:def:396 |
comment | Microsoft Internet Explorer 6 is installed | oval | oval:org.mitre.oval:def:563 |
comment | Microsoft Windows XP (32-bit) is installed | oval | oval:org.mitre.oval:def:1353 |
comment | Microsoft Windows XP x64 is installed | oval | oval:org.mitre.oval:def:15247 |
comment | Microsoft Windows Server 2003 (32-bit) is installed | oval | oval:org.mitre.oval:def:1870 |
comment | Microsoft Windows Server 2003 (x64) is installed | oval | oval:org.mitre.oval:def:730 |
comment | Microsoft Windows Server 2003 (ia64) Gold is installed | oval | oval:org.mitre.oval:def:396 |
comment | Microsoft Internet Explorer 7 is installed | oval | oval:org.mitre.oval:def:627 |
comment | Microsoft Windows Vista (32-bit) is installed | oval | oval:org.mitre.oval:def:1282 |
comment | Microsoft Windows Vista x64 Edition is installed | oval | oval:org.mitre.oval:def:2041 |
comment | Microsoft Windows Server 2008 (32-bit) is installed | oval | oval:org.mitre.oval:def:4870 |
comment | Microsoft Windows Server 2008 (64-bit) is installed | oval | oval:org.mitre.oval:def:5356 |
comment | Microsoft Windows Server 2008 (ia-64) is installed | oval | oval:org.mitre.oval:def:5667 |
comment | Microsoft Internet Explorer 7 is installed | oval | oval:org.mitre.oval:def:627 |
comment | Microsoft Windows Vista (32-bit) is installed | oval | oval:org.mitre.oval:def:1282 |
comment | Microsoft Windows Vista x64 Edition is installed | oval | oval:org.mitre.oval:def:2041 |
comment | Microsoft Windows Server 2008 (32-bit) is installed | oval | oval:org.mitre.oval:def:4870 |
comment | Microsoft Windows Server 2008 (64-bit) is installed | oval | oval:org.mitre.oval:def:5356 |
comment | Microsoft Windows Server 2008 (ia-64) is installed | oval | oval:org.mitre.oval:def:5667 |
comment | Microsoft Internet Explorer 7 is installed | oval | oval:org.mitre.oval:def:627 |
comment | Microsoft Windows XP (32-bit) is installed | oval | oval:org.mitre.oval:def:1353 |
comment | Microsoft Windows XP x64 is installed | oval | oval:org.mitre.oval:def:15247 |
comment | Microsoft Windows Server 2003 (32-bit) is installed | oval | oval:org.mitre.oval:def:1870 |
comment | Microsoft Windows Server 2003 (x64) is installed | oval | oval:org.mitre.oval:def:730 |
comment | Microsoft Internet Explorer 8 is installed | oval | oval:org.mitre.oval:def:6210 |
comment | Microsoft Windows Vista (32-bit) is installed | oval | oval:org.mitre.oval:def:1282 |
comment | Microsoft Windows Vista x64 Edition is installed | oval | oval:org.mitre.oval:def:2041 |
comment | Microsoft Windows Server 2008 (32-bit) is installed | oval | oval:org.mitre.oval:def:4870 |
comment | Microsoft Windows Server 2008 (64-bit) is installed | oval | oval:org.mitre.oval:def:5356 |
comment | Microsoft Internet Explorer 8 is installed | oval | oval:org.mitre.oval:def:6210 |
comment | Microsoft Windows 7 (32-bit) is installed | oval | oval:org.mitre.oval:def:6165 |
comment | Microsoft Windows 7 x64 Edition is installed | oval | oval:org.mitre.oval:def:5950 |
comment | Microsoft Windows Server 2008 R2 x64 Edition is installed | oval | oval:org.mitre.oval:def:6438 |
comment | Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed | oval | oval:org.mitre.oval:def:5954 |
comment | Microsoft Internet Explorer 8 is installed | oval | oval:org.mitre.oval:def:6210 |
comment | Microsoft Windows 7 (32-bit) is installed | oval | oval:org.mitre.oval:def:6165 |
comment | Microsoft Windows 7 x64 Edition is installed | oval | oval:org.mitre.oval:def:5950 |
comment | Microsoft Windows Server 2008 R2 x64 Edition is installed | oval | oval:org.mitre.oval:def:6438 |
comment | Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed | oval | oval:org.mitre.oval:def:5954 |
comment | Microsoft Internet Explorer 8 is installed | oval | oval:org.mitre.oval:def:6210 |
|
description | Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obtain sensitive information or conduct clickjacking attacks via a crafted web site, aka "Frame Tag Information Disclosure Vulnerability." |
family | windows |
id | oval:org.mitre.oval:def:11926 |
status | accepted |
submitted | 2011-04-12T13:00:00 |
title | Frame Tag Information Disclosure Vulnerability |
version | 79 |
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 47191 CVE ID: CVE-2011-1244 Windows Internet Explorer,原称Microsoft Internet Explorer,简称MSIE(一般称为Internet Explorer,简称IE),是微软公司推出的一款网页浏览器。 Microsoft Internet Explorer Frame标记在实现上存在跨域信息泄露漏洞,远程攻击者可利用此漏洞访问其他域或安全区域内的内容,获取敏感信息。 IE中存在信息泄露漏洞。攻击者通过构建伪装为合法内容的特制网页利用此漏洞。用户在该网页上的操作会导致信息泄露或用户单击执行意外操作的点击劫持。 Microsoft Internet Explorer 7.x Microsoft Internet Explorer 6.x 临时解决方法: * 以纯文本格式读取电子邮件 * 将“Internet"和本地内联网安全区域设置为“高”以在这些区域中禁用ActiveX控件和 Active脚本。 * 配置IE,在运行Active脚本之前提示或在互联网和内网安全区域中禁用Active脚本 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(MS11-018)以及相应补丁: MS11-018:Cumulative Security Update for Internet Explorer (2497640) 链接:http://www.microsoft.com/technet/security/bulletin/MS11-018.asp |
id | SSV:20476 |
last seen | 2017-11-19 |
modified | 2011-04-15 |
published | 2011-04-15 |
reporter | Root |
title | Microsoft IE Frame标记跨域信息泄露漏洞(MS11-018) |