Vulnerability

CERT-In Vulnerability Note CIVN-2017-0182
Multiple Vulnerabilities in Microsoft Internet Explorer

Original Issue Date:December 14, 2017

Severity Rating: HIGH

Software Affected

Windows 7 for 32-bit systems (SP1)
Windows 7 for x64-based systems (SP1)
Windows 8.1 for 32-bit Systems (Base)
Windows 8.1 or x64-based Systems (Base)
Windows 10 for 32-bit Systems (Base)
Windows 10 for x64-based Systems (Base)
Windows 10 1511 for 32-bit Systems (Base)
Windows 10 1511 for x64-based Systems (Base)
Windows 10 1607 for 32-bit Systems (Base)
Windows 10 1607 for x64-based Systems (Base)
Windows 10 1703 for 32-bit Systems (Base)
Windows 10 1703 for x64-based Systems (Base)
Windows 10 1709 for 32-bit Systems (Base)
Windows 10 1709 for x64-based Systems (Base)
Windows RT 8.1 (Base)
Windows Server 2008 Datacenter Edition (SP2)
Windows Server 2008 Datacenter Edition, 64-bit (SP2)
Windows Server 2008 Enterprise Edition (SP2)
Windows Server 2008 Enterprise Edition, 64-bit (SP2)
Windows Server 2008 Essential Business Server Standard (SP2)
Windows Server 2008 Essential Business Server Premium (SP2)
Windows Server 2008 Essential Business Server Premium, 64-bit (SP2)
Windows Server 2008 Standard Edition (SP2)
Windows Server 2008 Standard Edition, 64-bit (SP2)
Windows Server 2008 Web Server (SP2)
Windows Server 2008 Web Server, 64-bit (SP2)
Windows Server 2008 R2 x64-Based Systems Edition (SP1)
Windows Server 2012 Original Release (Base)
Windows Server 2012 R2 Original Release (Base)
Windows Server 2016 x64-Based Systems (Base)

Overview

Multiple vulnerabilities have been reported in Microsoft Internet Explorer that could allow an unauthenticated, remote attacker to obtain potentially sensitive information and execute arbitrary code on the targeted system.

Description

1. Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability ( CVE-2017-11886   CVE-2017-11901   CVE-2017-11903   CVE-2017-11907   CVE-2017-11913   )

This vulnerability is due to improper memory operations that are performed by the affected software. An attacker could exploit this vulnerability by persuading a user to access a link or file that submits malicious input to the affected software. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system.

2. Microsoft Internet Explorer Scripting Engine Information Disclosure Vulnerability ( CVE-2017-11887   CVE-2017-11906   )

This vulnerability is due to improper memory operations that are performed by the affected software. An attacker could exploit this vulnerability by persuading a user of a targeted system to access a link that submits malicious input to the affected software. Successful exploitation of this vulnerability could allow the attacker to access sensitive information on the targeted system.

3. Microsoft Internet Explorer Memory Corruption Vulnerability ( CVE-2017-11890   )

This vulnerability is due to improper memory operations that are performed by the affected software. An attacker could exploit this vulnerability by persuading a user to access a link or file that submits malicious input to the affected software. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system with the privileges of the user.

4. Microsoft Edge and Internet Explorer Memory Corruption Vulnerability ( CVE-2017-11894   CVE-2017-11895   CVE-2017-11912   CVE-2017-11930   )

This vulnerability is due to improper memory operations performed by the affected software. An attacker could exploit this vulnerability by persuading a user to access a link or file that submits malicious input to the affected software. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system with the privileges of the user.

5. Microsoft Edge and Internet Explorer Information Disclosure Vulnerability ( CVE-2017-11919   )

This vulnerability is due to improper memory operations performed by the affected software. An attacker could exploit this vulnerability by persuading a user to access a link or file that submits malicious input to the affected software. Successful exploitation of this vulnerability could allow the attacker to access sensitive information on the targeted system.

Solution

Apply appropriate software fixes as available on the vendor website.
https://portal.msrc.microsoft.com/en-us/security-guidance

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11906

https:// portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11890

Vendor Information

References

Security tracker
https://www.securitytracker.com/id/1039991
https://www.securitytracker.com/id/1039993

CVE Name
CVE-2017-11886
CVE-2017-11901
CVE-2017-11903
CVE-2017-11907
CVE-2017-11913
CVE-2017-11887
CVE-2017-11906
CVE-2017-11890
CVE-2017-11894
CVE-2017-11895
CVE-2017-11912
CVE-2017-11930
CVE-2017-11919

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India