Multiple vulnerabilities in Microsoft Internet Explorer

1) Information disclosure

EUVDB-ID: #VU2845

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C]

CVE-ID: CVE-2011-1245

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper handling of Javascript during certain processes. A remote attacker can create a specially crafted Web page, trick the victim into visiting it and bypass cross-domain security restrictions and obtain sensitive information from another security zone or domain.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Mitigation

Vulnerable software versions

Microsoft Internet Explorer: 6 - 8

External links

http://technet.microsoft.com/en-us/library/security/ms11-018.aspx

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

2) Information disclosure

EUVDB-ID: #VU2844

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C]

CVE-ID: CVE-2011-1244

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error related to frame tags. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and hijack the victim's click actions to obtain sensitive information from different domains.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Mitigation

Vulnerable software versions

Microsoft Internet Explorer: 6 - 8

External links

http://technet.microsoft.com/en-us/library/security/ms11-018.aspx

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

3) “Use-after-free” error

EUVDB-ID: #VU2843

Risk: High

CVSSv3.1: 8.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2011-0346

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error n the ReleaseInterface() function within the mshtml.dll library when handling circular references between JScript objects and DOM objects. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Mitigation

Vulnerable software versions

Microsoft Internet Explorer: 6 - 8

External links

http://technet.microsoft.com/en-us/library/security/ms11-018.aspx

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

4) Use-after-free error

EUVDB-ID: #VU2842

Risk: Critical

CVSSv3.1: 9.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2011-0094

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when handling layout objects that have not been correctly initialized or have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Mitigation

Vulnerable software versions

Microsoft Internet Explorer: 6 - 8

External links

http://technet.microsoft.com/en-us/library/security/ms11-018.aspx

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

Risk	Critical
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2011-1245 CVE-2011-1244 CVE-2011-0346 CVE-2011-0094
CWE-ID	CWE-200 CWE-119 CWE-416
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. Vulnerability #4 is being exploited in the wild.
Vulnerable software Subscribe	Microsoft Internet Explorer Client/Desktop applications / Web browsers
Vendor	Microsoft