Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Cumulative Security Update for Internet Explorer (2360131) |
| Informations | |||
|---|---|---|---|
| Name | MS10-071 | First vendor Publication | 2010-10-12 |
| Vendor | Microsoft | Last vendor Modification | 2010-10-13 |
| Severity (Vendor) | Critical | Revision | 1.1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.1 (October 13, 2010): Corrected the update package names for Internet Explorer in the Windows Server 2008 deployment reference table. This is an informational change only. Customers who have already successfully updated their systems do not need to take any action.Summary: This security update resolves seven privately reported vulnerabilities and three publicly disclosed vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS10-071.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 40 % | CWE-200 | Information Exposure |
| 30 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
| 20 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
| 10 % | CWE-416 | Use After Free |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:6832 | |||
| Oval ID: | oval:org.mitre.oval:def:6832 | ||
| Title: | Uninitialized Memory Corruption Vulnerability (CVE-2010-3331) | ||
| Description: | Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory in certain circumstances involving use of Microsoft Word to read Word documents, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3331 | Version: | 9 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6889 | |||
| Oval ID: | oval:org.mitre.oval:def:6889 | ||
| Title: | AutoComplete Information Disclosure Vulnerability | ||
| Description: | Microsoft Internet Explorer 6 and 7 on Windows XP and Vista does not prevent script from simulating user interaction with the AutoComplete feature, which allows remote attackers to obtain sensitive form information via a crafted web site, aka "AutoComplete Information Disclosure Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-0808 | Version: | 7 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6928 | |||
| Oval ID: | oval:org.mitre.oval:def:6928 | ||
| Title: | Cross-Domain Information Disclosure Vulnerability | ||
| Description: | Microsoft Internet Explorer 6 through 8 does not properly restrict script access to content from a different (1) domain or (2) zone, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Cross-Domain Information Disclosure Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3330 | Version: | 9 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7059 | |||
| Oval ID: | oval:org.mitre.oval:def:7059 | ||
| Title: | Uninitialized Memory Corruption Vulnerability (CVE-2010-3328) | ||
| Description: | Use-after-free vulnerability in the CAttrArray::PrivateFind function in mshtml.dll in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code by setting an unspecified property of a stylesheet object, aka "Uninitialized Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3328 | Version: | 9 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7207 | |||
| Oval ID: | oval:org.mitre.oval:def:7207 | ||
| Title: | Uninitialized Memory Corruption Vulnerability | ||
| Description: | Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3326 | Version: | 3 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | Microsoft Internet Explorer 6 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7275 | |||
| Oval ID: | oval:org.mitre.oval:def:7275 | ||
| Title: | HTML Sanitization Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3243 | Version: | 3 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Microsoft Office SharePoint Server 2007 Microsoft Windows SharePoint Services 3.0 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7297 | |||
| Oval ID: | oval:org.mitre.oval:def:7297 | ||
| Title: | HTML Sanitization Vulnerability (CVE-2010-3324) | ||
| Description: | The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule, aka "HTML Sanitization Vulnerability," a different vulnerability than CVE-2010-1257. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3324 | Version: | 13 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 8 Microsoft Windows SharePoint Services 3.0 Microsoft Office SharePoint Server 2007 Microsoft Office SharePoint Foundation 2010 Microsoft Groove Server 2010 Microsoft Office Web Apps |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7410 | |||
| Oval ID: | oval:org.mitre.oval:def:7410 | ||
| Title: | CSS Special Character Information Disclosure Vulnerability | ||
| Description: | Microsoft Internet Explorer 6 through 8 does not properly handle unspecified special characters in Cascading Style Sheets (CSS) documents, which allows remote attackers to obtain sensitive information from a different (1) domain or (2) zone via a crafted web site, aka "CSS Special Character Information Disclosure Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3325 | Version: | 9 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7417 | |||
| Oval ID: | oval:org.mitre.oval:def:7417 | ||
| Title: | Anchor Element Information Disclosure Vulnerability | ||
| Description: | The implementation of HTML content creation in Microsoft Internet Explorer 6 through 8 does not remove the Anchor element during pasting and editing, which might allow remote attackers to obtain sensitive deleted information by visiting a web page, aka "Anchor Element Information Disclosure Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3327 | Version: | 9 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 6 Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7482 | |||
| Oval ID: | oval:org.mitre.oval:def:7482 | ||
| Title: | Uninitialized Memory Corruption Vulnerability (CVE-2010-3329) | ||
| Description: | mshtmled.dll in Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code via a crafted Microsoft Office document that causes the HtmlDlgHelper class destructor to access uninitialized memory, aka "Uninitialized Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3329 | Version: | 9 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 7 Microsoft Internet Explorer 8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7637 | |||
| Oval ID: | oval:org.mitre.oval:def:7637 | ||
| Title: | HTML Sanitization Vulnerability (CVE-2010-3243) | ||
| Description: | Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-3243 | Version: | 12 |
| Platform(s): | Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 | Product(s): | Microsoft Internet Explorer 8 Microsoft Office SharePoint Server 2007 Microsoft Windows SharePoint Services 3.0 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 | |
| Application | 3 | |
| Application | 1 | |
| Application | 3 | |
| Application | 2 | |
| Application | 1 |
ExploitDB Exploits
| id | Description |
|---|---|
| 2010-10-16 | Microsoft Office HtmlDlgHelper Class Memory Corruption |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-09-22 | Name : Microsoft SharePoint SafeHTML Information Disclosure Vulnerabilities (2412048) File : nvt/secpod_ms10-072.nasl |
| 2010-12-15 | Name : Microsoft Internet Explorer Multiple Vulnerabilities (2416400) File : nvt/secpod_ms10-090.nasl |
| 2010-10-13 | Name : Microsoft Internet Explorer Multiple Vulnerabilities (2360131) File : nvt/secpod_ms10-071.nasl |
| 2010-09-23 | Name : Microsoft Internet Explorer 'toStaticHTML()' Cross Site Scripting Vulnerability File : nvt/secpod_ms_ie_static_html_xss_vuln.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 68548 | Microsoft IE / SharePoint Unspecified XSS Microsoft SharePoint Server and Groove server contains a flaw that may lead to an unauthorized information disclosure. Â The issue is triggered when the application does not properly sanitise HTML code using SafeHTML. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed |
| 68547 | Microsoft IE CSS Special Character Processing Unspecified Information Disclosure Microsoft IE contains a flaw that may lead to an unauthorized information disclosure. Â The issue is exists in the way that Internet Explorer processes CSS special characters. It can view content from another domain or Internet Explorer zone. |
| 68546 | Microsoft IE Object Handling Unspecified Memory Corruption (2010-3326) Microsoft IE contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. It can take complete control of an affected system. |
| 68545 | Microsoft IE Anchor Element Handling Unspecified Information Disclosure Microsoft IE contains a flaw that may lead to an unauthorized information disclosure. Â The issue is triggered in the way that Internet Explorer improperly handles the Anchor element. This behavior occurs during user operation when the Anchor element is not removed during content pasting and editing, potentially revealing sensitive information intended for deletion. |
| 68544 | Microsoft IE AutoComplete Functionality Unspecified Information Disclosure Microsoft IE contains a flaw that may lead to an unauthorized information disclosure. Â The issue is that potentially allows form data within Internet Explorer to be captured via the AutoComplete feature.It can capture information previously entered into fields after the AutoComplete feature has been enabled |
| 68543 | Microsoft IE HtmlDlgHelper Class Object Handling Memory Corruption Microsoft IE contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to Internet Explorer accesses an object that has not been correctly initialized or has been deleted when a document in an HTML format is opened in Microsoft Word. An attacker could exploit the vulnerability by convincing the user to open a malicious Word document. When a user closes the document, it could allow remote code execution. |
| 68542 | Microsoft IE CSS imports() Cross-domain Information Disclosure Microsoft IE contains a flaw that may lead to an unauthorized information disclosure. Â The issue could allow script to gain access to information in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page. An attacker who successfully exploited this vulnerability could view content from another domain or Internet Explorer zone. |
| 68541 | Microsoft IE mshtml.dll CAttrArray::PrivateFind Function Object Handling Memo... Microsoft IE contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, it could allow remote code execution. |
| 68540 | Microsoft IE mshtml.dll Object Handling Uninitialized Memory Corruption (2010... Microsoft IE contains a flaw that may allow a remote attacker to execute arbitrary commands or code. The issue is due to the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by convincing a user to view a specially crafted Word document. When a user closes the Word document, it could allow remote code execution |
| 68123 | Microsoft IE / SharePoint toStaticHTML Function Crafted CSS @import Rule XSS ... Microsoft SharePoint contains a flaw that may lead to an unauthorized information disclosure. Â The issue is triggered when the application does not properly sanitise HTML code using SafeHTML. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2018-02-22 | toStaticHTML CSS import XSS exploit attempt RuleID : 45514 - Revision : 1 - Type : BROWSER-IE |
| 2017-07-11 | Microsoft Internet Explorer CStyleSheetRule array memory corruption attempt RuleID : 43134 - Revision : 1 - Type : BROWSER-IE |
| 2016-03-14 | Microsoft Internet Explorer Scriptlet Component ActiveX clsid access RuleID : 36772 - Revision : 2 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Microsoft HtmlDlgHelper ActiveX clsid access RuleID : 23555 - Revision : 7 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Internet Explorer CStyleSheetRule array memory corruption attempt RuleID : 19436 - Revision : 14 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer Cross-Domain information disclosure attempt RuleID : 19411 - Revision : 9 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer and SharePoint toStaticHTML information disclosur... RuleID : 19322 - Revision : 10 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer 8 CSS XSRF exploit attempt RuleID : 17774 - Revision : 8 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer Scriptlet Component ActiveX clsid access RuleID : 17772 - Revision : 15 - Type : BROWSER-PLUGINS |
| 2014-01-10 | Microsoft Internet Explorer cross-domain information disclosure attempt RuleID : 17771 - Revision : 12 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft HtmlDlgHelper ActiveX clsid access RuleID : 17770 - Revision : 18 - Type : FILE-OFFICE |
| 2014-01-10 | Microsoft Internet Explorer 8 CSS invalid mapping exploit attempt RuleID : 17769 - Revision : 13 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer 8 object event handler use after free exploit att... RuleID : 17768 - Revision : 15 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer 8 tostaticHTML CSS import vulnerability RuleID : 17767 - Revision : 15 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer 8 XSS in toStaticHTML API attempt RuleID : 17766 - Revision : 15 - Type : BROWSER-IE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-10-18 | Name : The remote host is affected by multiple cross-site scripting vulnerabilities. File : safehtml_ms10_072.nasl - Type : ACT_GATHER_INFO |
| 2010-10-13 | Name : Arbitrary code can be executed on the remote host through a web browser. File : smb_nt_ms10-071.nasl - Type : ACT_GATHER_INFO |
| 2010-10-13 | Name : The remote host is affected by multiple cross-site scripting vulnerabilities. File : smb_nt_ms10-072.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:46:42 |
|
| 2014-01-19 21:30:31 |
|
