Microsoft VBScript And JScript Scripting Engines Integer Overflow Code Execution Vulnerability

ID SMNTC-54945
Type symantec
Reporter Symantec Security Response
Modified 2012-08-14T00:00:00



Microsoft VBScript and JScript scripting engines are prone to a remote code-execution vulnerability due to an integer-overflow error. Attackers can leverage this issue by enticing unsuspecting users to view a malicious webpage. Successful exploits would allow arbitrary code to run with the privileges of the currently logged-in user. Note: This issue affects only 64-bit Windows clients.

Technologies Affected

  • Microsoft Internet Explorer 8
  • Microsoft Internet Explorer 9
  • Microsoft JScript 5.6
  • Microsoft JScript 5.7
  • Microsoft JScript 5.8
  • Microsoft VBScript 5.6
  • Microsoft VBScript 5.7
  • Microsoft VBScript 5.8


Run all software as a nonprivileged user with minimal access rights.
To limit the potential damage that successful exploits may achieve, run all nonadministrative software as an unprivileged user.

Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This may indicate exploit attempts or activity that results from successful exploits.

Do not follow links provided by unknown or untrusted sources.
Attackers can exploit this vulnerability by enticing a user to visit a malicious website. Do not follow links provided by sources of questionable integrity. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.

Set web browser security to disable the execution of JavaScript.
Since exploiting this issue allows malicious script code to run in web clients, consider disabling support for script code and active content within the client browser. Note that this mitigation tactic might adversely affect websites that rely on the execution of browser-based script code.

Do not open email messages from unknown or untrusted individuals.
Attackers could exploit this vulnerability through HTML email messages. Do not accept any email from sources of questionable integrity.

The vendor has released a security advisory and fixes. Please see the references for details.