Kaspersky LabKLA11084

HistoryAug 08, 2017 - 12:00 a.m.

KLA11084 Multiple vulnerabilities in Microsoft Edge and Microsoft Internet Explorer

2017-08-0800:00:00

Kaspersky Lab

threats.kaspersky.com

CVSS2

7.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.955

Percentile

99.4%

JSON

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer and Microsoft Edge. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, execute arbitrary code and obtain sensitive information.

Below is a complete list of vulnerabilities:

An incorrect handling of sandboxing in Microsoft Edge can be exploited locally to gain privileges;
An improper validation of UMCI (User Mode Code Integrity) policies can be exploited locally by convincing a user to visit a specially designed website and run a malicious application to bypass security restrictions;
Multiple vulnerabilities related to improper handling of objects in memory in JavaScript engines can be exploited remotely via a specially designed website, Microsoft Office document that hosts the browser rendering engine or embedded ActiveX control marked “safe for initialization” in an application to execute arbitrary code;
The ACG (Arbitrary Code Guard) bypass vulnerability related to an improper handling of accessing memory in code which is compiled by the Microsoft Edge JIT (Just-In-Time) compiler can be exploited remotely via a specially designed website to bypass security restrictions;
An improper validation and sanitizing of JavaScript parameters in Microsoft Edge can be exploited remotely by convincing a user to click a specially designed link hosted on a malicious website to gain privileges;
Multiple vulnerabilities related to an incorrect handling of objects in memory in certain functions in Microsoft Edge can be exploited remotely by convincing a user to view a specially designed website to obtain sensitive information;
An improper enforcing of cross-domain policies in Microsoft Edge can be exploited remotely by convincing a user to load a specially designed page or visit a malicious website to bypass security restrictions;
An incorrect handling of objects in memory in Microsoft Internet Explorer can be exploited remotely by convincing a user to view a specially designed website to execute arbitrary code;
Multiple vulnerabilities related to an improper handling of objects in memory can be exploited remotely by convincing a user to view a specially designed website to execute arbitrary code;
An incorrect handling of objects in memory in certain functions in the Chakra scripting engine can be exploited remotely by convincing a user to view a specially designed website to obtain sensitive information;
An incorrect handling of objects in memory in Microsoft scripting engines in Microsoft Edge can be exploited remotely via a specially designed website, Microsoft Office document that hosts the browser rendering engine or embedded ActiveX control marked “safe for initialization” in an application to execute arbitrary code;
An improper validation of strings in affected scenarios can be exploited remotely via a specially designed website to obtain sensitive information;
Multiple vulnerabilities related to an improper handling of objects in memory in Microsoft Edge can be exploited remotely by convincing a user to view a specially designed website to execute arbitrary code;
An improper handling of objects in memory in the Chakra JavaScript scripting engine can be exploited remotely to execute arbitrary code.

Technical details

To exploit vulnerabilities (9) and (13), an attacker can send an URL to the malicious website via email or instant message.

Exploit of vulnerability (12) allows attackers to get sensitive data from memory and possibly bypass ASLR (Address Space Layout Randomization).

Original advisories

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Internet-Explorer

Microsoft-Edge

CVE list

CVE-2017-8503 critical

CVE-2017-8625 critical

CVE-2017-8634 critical

CVE-2017-8635 critical

CVE-2017-8636 critical

CVE-2017-8637 high

CVE-2017-8638 critical

CVE-2017-8639 critical

CVE-2017-8640 critical

CVE-2017-8641 critical

CVE-2017-8642 high

CVE-2017-8644 warning

CVE-2017-8645 critical

CVE-2017-8646 critical

CVE-2017-8647 critical

CVE-2017-8650 high

CVE-2017-8651 critical

CVE-2017-8652 high

CVE-2017-8653 critical

CVE-2017-8655 critical

CVE-2017-8656 critical

CVE-2017-8657 critical

CVE-2017-8659 warning

CVE-2017-8661 critical

CVE-2017-8662 warning

CVE-2017-8669 critical

CVE-2017-8670 critical

CVE-2017-8671 critical

CVE-2017-8672 critical

CVE-2017-8674 critical

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

Microsoft Internet Explorer versions 9 through 11Microsoft Edge

References

support.microsoft.com/kb/4034658

support.microsoft.com/kb/4034660

support.microsoft.com/kb/4034664

support.microsoft.com/kb/4034665

support.microsoft.com/kb/4034668

support.microsoft.com/kb/4034674

support.microsoft.com/kb/4034681

support.microsoft.com/kb/4034733

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8503

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8634

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8635

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8636

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8637

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8638

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8639

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8640

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8641

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8642

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8644

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8645

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8646

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8647

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8650

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8651

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8652

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8653

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8655

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8656

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8657

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8659

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8661

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8662

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8669

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8670

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8671

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8672

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8674

statistics.securelist.com/

threats.kaspersky.com/en/class/Exploit/

threats.kaspersky.com/en/product/Microsoft-Edge/

threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/