Executive Summary
Summary | |
---|---|
Title | Cumulative Security Update for Internet Explorer (956390) |
Informations | |||
---|---|---|---|
Name | MS08-058 | First vendor Publication | 2008-10-14 |
Vendor | Microsoft | Last vendor Modification | 2008-11-12 |
Severity (Vendor) | Critical | Revision | 1.2 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Revision Note: V1.2 (November 12, 2008): Corrected a registry key verification entry for Internet Explorer 6 for all supported x64-based editions of Windows Server 2003.Summary: This security update resolves five privately reported vulnerabilities and one publicly disclosed vulnerability. The vulnerabilities could allow information disclosure or remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
Url : http://www.microsoft.com/technet/security/bulletin/MS08-058.mspx |
CAPEC : Common Attack Pattern Enumeration & Classification
Id | Name |
---|---|
CAPEC-26 | Leveraging Race Conditions |
CAPEC-29 | Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions |
CAPEC-172 | Time and State Attacks |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
40 % | CWE-264 | Permissions, Privileges, and Access Controls |
20 % | CWE-399 | Resource Management Errors |
20 % | CWE-284 | Access Control (Authorization) Issues |
20 % | CWE-200 | Information Exposure |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:12364 | |||
Oval ID: | oval:org.mitre.oval:def:12364 | ||
Title: | Information disclosure vulnerability in Internet Explorer due to HTML element | ||
Description: | Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, via a crafted HTML document, aka "HTML Element Cross-Domain Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2008-3472 | Version: | 8 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:13151 | |||
Oval ID: | oval:org.mitre.oval:def:13151 | ||
Title: | Uninitialized Memory Corruption Vulnerability in Internet Explorer | ||
Description: | Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2008-3475 | Version: | 3 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Internet Explorer 6 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:13255 | |||
Oval ID: | oval:org.mitre.oval:def:13255 | ||
Title: | Information disclosure vulnerability in Internet Explorer due to improper event-handling | ||
Description: | Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, via a crafted HTML document, aka "Event Handling Cross-Domain Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2008-3473 | Version: | 8 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:13299 | |||
Oval ID: | oval:org.mitre.oval:def:13299 | ||
Title: | Cross-Domain Information Disclosure Vulnerability in Internet Explorer | ||
Description: | Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy and obtain sensitive information via a crafted HTML document, aka "Cross-Domain Information Disclosure Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2008-3474 | Version: | 8 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:13344 | |||
Oval ID: | oval:org.mitre.oval:def:13344 | ||
Title: | HTML Objects Memory Corruption Vulnerability in Internet Explorer | ||
Description: | Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Objects Memory Corruption Vulnerability." | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2008-3476 | Version: | 3 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Internet Explorer 5.01 Microsoft Internet Explorer 6 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:5901 | |||
Oval ID: | oval:org.mitre.oval:def:5901 | ||
Title: | Window Location Property Cross-Domain Vulnerability | ||
Description: | Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a (1) location or (2) location.href property, related to incorrect determination of the origin of web script, aka "Window Location Property Cross-Domain Vulnerability." NOTE: according to Microsoft, CVE-2008-2948 and CVE-2008-2949 are duplicates of this issue, probably different attack vectors. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2008-2947 | Version: | 8 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP | Product(s): | Microsoft Internet Explorer 5.01 Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2008-10-15 | Name : Cumulative Security Update for Internet Explorer (956390) File : nvt/secpod_ms08-058_900054.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
49118 | Microsoft IE HTML Object Handling Memory Corruption |
49117 | Microsoft IE componentFromPoint Unitialized Memory Corruption |
49116 | Microsoft IE Unspecified Cross-domain Information Disclosure |
49115 | Microsoft IE Unspecified Cross-domain Arbitrary Script Execution |
49114 | Microsoft IE Unspecified HTML Element Cross-Domain Code Execution |
49113 | Microsoft IE Window Location Property Cross-Domain Code Execution |
46630 | Microsoft IE location Window Object Handling XSS |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | Microsoft Internet Explorer cross domain componentFromPoint memory corruption... RuleID : 14657 - Revision : 14 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer XSS mouseevent PII disclosure attempt RuleID : 14656 - Revision : 13 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer cross domain setExpression exploit attempt RuleID : 14645 - Revision : 18 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer createRange cross domain scripting RuleID : 14644 - Revision : 19 - Type : BROWSER-IE |
2014-01-10 | Microsoft Internet Explorer location and location.href cross domain security ... RuleID : 14643 - Revision : 14 - Type : BROWSER-IE |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2008-10-15 | Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms08-058.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:46:04 |
|
2014-01-19 21:30:15 |
|
2013-05-11 00:49:22 |
|