Lucene search

Kaspersky LabKLA10967

HistoryMar 14, 2017 - 12:00 a.m.

KLA10967 Multiple vulnerabilities in Microsoft Browser

2017-03-1400:00:00

Kaspersky Lab

threats.kaspersky.com

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

0.974 High

EPSS

Percentile

99.9%

JSON

Detect date:

03/14/2017

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, execute arbitrary code, spoof user interface.

Affected products:

Internet Explorer 9
Internet Explorer 11
Internet Explorer 10
Microsoft Edge (EdgeHTML-based)

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2017-0065
CVE-2017-0066
CVE-2017-0067
CVE-2017-0068
CVE-2017-0069
CVE-2017-0070
CVE-2017-0071
CVE-2017-0094
CVE-2017-0037
CVE-2017-0131
CVE-2017-0132
CVE-2017-0133
CVE-2017-0134
CVE-2017-0135
CVE-2017-0136
CVE-2017-0137
CVE-2017-0138
CVE-2017-0140
CVE-2017-0141
CVE-2017-0150
CVE-2017-0151
CVE-2017-0009
CVE-2017-0010
CVE-2017-0011
CVE-2017-0012
CVE-2017-0015
CVE-2017-0017
CVE-2017-0023
CVE-2017-0032
CVE-2017-0033
CVE-2017-0034
CVE-2017-0035
CVE-2017-0049
CVE-2017-0059
CVE-2017-0130
CVE-2017-0149
CVE-2017-0154
CVE-2017-0008
CVE-2017-0018
CVE-2017-0040

Impacts:

ACE

Related products:

Microsoft Internet Explorer

CVE-IDS:

CVE-2017-00654.3Warning
CVE-2017-00664.0Warning
CVE-2017-00684.3Warning
CVE-2017-00694.3Warning
CVE-2017-00377.6Critical
CVE-2017-01354.0Warning
CVE-2017-01404.0Warning
CVE-2017-00094.3Warning
CVE-2017-00114.3Warning
CVE-2017-00124.3Warning
CVE-2017-00174.3Warning
CVE-2017-00237.6Critical
CVE-2017-00334.3Warning
CVE-2017-00494.3Warning
CVE-2017-00594.3Warning
CVE-2017-01307.6Critical
CVE-2017-01497.6Critical
CVE-2017-01545.8High
CVE-2017-00084.3Warning
CVE-2017-00187.6Critical
CVE-2017-00407.6Critical

Microsoft official advisories:

KB list:

4025342
4012204
4012217
4012215
4012216
4012606
4013198
4013429
4025339
4025344
4025338

Exploitation:

The following public exploits exists for this vulnerability:

References

support.microsoft.com/kb/4012204

support.microsoft.com/kb/4012215

support.microsoft.com/kb/4012216

support.microsoft.com/kb/4012217

support.microsoft.com/kb/4012606

support.microsoft.com/kb/4013198

support.microsoft.com/kb/4013429

support.microsoft.com/kb/4025338

support.microsoft.com/kb/4025339

support.microsoft.com/kb/4025342

support.microsoft.com/kb/4025344

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0008

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0009

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0011

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0012

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0017

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0018

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0023

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0033

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0037

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0040

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0049

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0059

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0065

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0066

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0068

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0069

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0130

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0135

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0140

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0149

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0154

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0008

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0009

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0010

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0011

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0012

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0015

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0017

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0018

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0023

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0032

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0033

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0034

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0035

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0037

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0040

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0049

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0059

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0065

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0066

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0067

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0068

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0069

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0070

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0071

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0094

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0130

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0131

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0132

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0133

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0134

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0135

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0136

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0137

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0138

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0140

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0141

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0149

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0150

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0151

portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-0154

portal.msrc.microsoft.com/en-us/security-guidance

statistics.securelist.com/vulnerability-scan/month

threats.kaspersky.com/en/product/Microsoft-Edge/

threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/

www.exploit-db.com/exploits/41454

www.exploit-db.com/exploits/41623

www.exploit-db.com/exploits/41661

www.exploit-db.com/exploits/42354

www.exploit-db.com/exploits/43125

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.6 High

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

0.974 High

EPSS

Percentile

99.9%

JSON

Related for KLA10967