Vulnerability

CERT-In Vulnerability Note CIVN-2013-0197
Multiple Vulnerabilities in Microsoft Internet Explorer

Original Issue Date:November 13, 2013

Severity Rating: HIGH

Systems Affected

Windows XP SP 3 and Professional x64 Edition SP 2
Windows Server 2003 SP 2, x64 Edition SP 2 and SP2 for Itanium-based Systems
Windows Vista SP 2 and x64 Edition SP 2
Windows Server 2008 SP2 for 32-bit Systems, x64-based Systems and Itanium-based Systems
Windows 7 SP 1 for 32-bit Systems and x64-based Systems
Windows Server 2008 R2 SP 1 for x64-based Systems and Itanium-based Systems
Windows 8 for 32-bit Systems and x64-based Systems
Windows Server 2012
Windows RT
Windows RT 8.1
Windows 8.1 for 32-bit Systems and x64-based Systems
Windows Server 2012 R2

Component Affected

Internet Explorer 6,7,8,9,10, 11

Overview

Multiple vulnerabilities have been reported in Microsoft Internet Explorer which could allow a remote attacker to execute arbitrary code and disclose sensitive information on the targeted system.

Description

1. Information Disclosure Vulnerability ( CVE-2013-3908 )

An information disclosure vulnerability exists in Microsoft Internet Explorer due to improper handling of specially crafted web content while the print preview is generated. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted web page and initiate a print preview. Successful exploitation of this vulnerability could allow an attacker to access sensitive information being viewed in any webpage in the targeted user's browser.

Workaround

Do not use the Print Preview feature in Internet Explorer
Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

2. Information Disclosure Vulnerability ( CVE-2013-3909 )

An information disclosure vulnerability exists in Microsoft Internet Explorer due to improper processing of CSS special characters. An attacker could exploit this vulnerability by convincing the targeted user to visit a specially crafted website. Successful exploitation of this vulnerability could lead to disclosure of sensitive information.

3. Multiple Memory Corruption Vulnerabilities in Internet Explorer ( CVE-2013-3871 CVE-2013-3910 CVE-2013-3911 CVE-2013-3912 CVE-2013-3914 CVE-2013-3915 CVE-2013-3916 CVE-2013-3917 )

Multiple remote code execution vulnerabilities exist in Microsoft Internet Explorer due to improper handling of objects in the memory. A remote attacker could exploit these vulnerabilities by enticing the targeted user to visit a specially crafted website via Internet Explorer. Successful exploitation of theses vulnerabilities could lead to execution of arbitrary code in context of the logged-in user.

Solution

Apply appropriate updates as mentioned in the Microsoft Security Bulletin MS13-088

Vendor Information

Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms13-088

References

SecurityFocus
http://www.securityfocus.com/bid/63585
http://www.securityfocus.com/bid/63588
http://www.securityfocus.com/bid/63590
http://www.securityfocus.com/bid/63592
http://www.securityfocus.com/bid/63593
http://www.securityfocus.com/bid/63594
http://www.securityfocus.com/bid/63595
http://www.securityfocus.com/bid/63596
http://www.securityfocus.com/bid/63597
http://www.securityfocus.com/bid/62802

Symantec
http://www.symantec.com/security_response/vulnerability.jsp?bid=63585&om_rssid=sr-advisories
http://www.symantec.com/security_response/vulnerability.jsp?bid=63588&om_rssid=sr-advisories
http://www.symantec.com/security_response/vulnerability.jsp?bid=63590&om_rssid=sr-advisories
http://www.symantec.com/security_response/vulnerability.jsp?bid=63592&om_rssid=sr-advisories
http://www.symantec.com/security_response/vulnerability.jsp?bid=63593&om_rssid=sr-advisories
http://www.symantec.com/security_response/vulnerability.jsp?bid=63594&om_rssid=sr-advisories
http://www.symantec.com/security_response/vulnerability.jsp?bid=63596&om_rssid=sr-advisories

CVE Name
CVE-2013-3908
CVE-2013-3909
CVE-2013-3871
CVE-2013-3910
CVE-2013-3911
CVE-2013-3912
CVE-2013-3914
CVE-2013-3915
CVE-2013-3916
CVE-2013-3917

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India