Internet Explorer on Microsoft Windows 8.1 and Windows RT 8.1, and Windows Server 2012 R2 allows an attacker to execute arbitrary code in the context of the current user when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability".

The Internet Explorer installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists when     Microsoft browsers improperly handle redirect requests.
    The vulnerability allows Microsoft browsers to bypass     CORS redirect restrictions, and to follow redirect     requests that should otherwise be ignored. An attacker     who successfully exploited the vulnerability could force     the browser to send data that would otherwise be     restricted to a destination website of the attacker's     choice.  (CVE-2017-8592)

  - A spoofing vulnerability exists when an affected     Microsoft browser does not properly parse HTTP content.
    An attacker who successfully exploited this     vulnerability could trick a user by redirecting the user     to a specially crafted website. The specially crafted     website could either spoof content or serve as a pivot     to chain an attack with other vulnerabilities in web     services.  (CVE-2017-8602)

  - A remote code execution vulnerability exists in the way     that the VBScript engine, when rendered in Internet     Explorer, handles objects in memory. In a web-based     attack scenario, an attacker could host a specially     crafted website that is designed to exploit this     vulnerability through Internet Explorer and then     convince a user to view the website. An attacker could     also embed an ActiveX control marked &quot;safe for     initialization&quot; in an application or Microsoft     Office document that hosts the Internet Explorer     rendering engine. The attacker could also take advantage     of compromised websites and websites that accept or host     user-provided content or advertisements. These websites     could contain specially crafted content that could     exploit this vulnerability. An attacker who successfully     exploited this vulnerability could gain the same user     rights as the current user.  (CVE-2017-8618)

  - A remote code execution vulnerability exists in the way     JavaScript engines render when handling objects in     memory in Microsoft browsers. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2017-8606, CVE-2017-8607,     CVE-2017-8608)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory     via the Microsoft Windows Text Services Framework. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2017-8594)

The remote Windows host is missing security update 4025333 or cumulative update 4025336. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Windows Performance Monitor Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to create a     Data Collector Set and import a specially crafted XML     file, to disclose arbitrary files via an XML external     entity (XXE) declaration. (CVE-2017-0170)

  - A remote code execution vulnerability exists in Windows     Explorer due to improper handling of executable files     and shares during rename operations. An unauthenticated,     remote attacker can exploit this, by convincing a user     to open a specially crafted file, to execute arbitrary     code in the context of the current user. (CVE-2017-8463)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8467)

  - An information disclosure vulnerability exists in Win32k     due to improper handling of objects in memory. A local     attacker can exploit this, via a specially crafted     application, to disclose sensitive information.
    (CVE-2017-8486)

  - A security bypass vulnerability exists in Microsoft     Windows when handling Kerberos ticket exchanges due to a     failure to prevent tampering with the SNAME field. A     man-in-the-middle attacker can exploit this to bypass     the Extended Protection for Authentication security     feature. (CVE-2017-8495)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8556)

  - An information disclosure vulnerability exists in the     Windows System Information Console due to improper     parsing of XML input that contains a reference to an     external entity. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted file, to disclose arbitrary files via     an XML external entity (XXE) declaration.
    (CVE-2017-8557)

  - An elevation of privilege vulnerability exists in the     Windows kernel due to improper handling of objects in     memory. A local attacker can exploit this, via a     specially crafted application, to execute arbitrary code     with elevated permissions. (CVE-2017-8561)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of calls to Advanced     Local Procedure Call (ALPC). An authenticated, remote     attacker can exploit this via a specially crafted     application, to run processes in an elevated context.
    (CVE-2017-8562)

  - An elevation of privilege vulnerability exists in     Windows due to Kerberos falling back to NT LAN Manager     (NTLM) Authentication Protocol as the default     authentication protocol. An authenticated, remote     attacker can exploit this, via an application that     sends specially crafted traffic to a domain controller,     to run processes in an elevated context. (CVE-2017-8563)

  - An information disclosure vulnerability exists in the     Windows kernel due to improper initialization of objects     in memory. An authenticated, remote attacker can exploit     this, via a specially crafted application, to bypass     Kernel Address Space Layout Randomization (KASLR) and     disclose the base address of the kernel driver.
    (CVE-2017-8564)

  - A remote code execution vulnerability exists in     PowerShell when handling a PSObject that wraps a CIM     instance. An authenticated, remote attacker can exploit     this, via a specially crafted script, to execute     arbitrary code in a PowerShell remote session.
    (CVE-2017-8565)

  - An elevation of privilege vulnerability exists in the     Microsoft Graphics component due to improper handling     of objects in memory. A local attacker can exploit this,     via a specially crafted application, to run arbitrary     code in kernel mode. (CVE-2017-8573)

  - Multiple elevation of privilege vulnerabilities exist in     the Microsoft Graphics Component due to improper     handling of objects in memory. A local attacker can     exploit these, via a specially crafted application, to     run arbitrary code in kernel mode. (CVE-2017-8577,     CVE-2017-8578, CVE-2017-8580)

  - An elevation of privilege vulnerability exists in     Windows due to improper handling of objects in memory. A     local attacker can exploit this, via a specially crafted     application, to run arbitrary code in kernel mode.
    (CVE-2017-8581)

  - An information disclosure vulnerability exists in the     HTTP.sys server application component due to improper     handling of objects in memory. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to disclose sensitive information.
    (CVE-2017-8582)

  - A denial of service vulnerability exists in Windows     Explorer that is triggered when Explorer attempts to     open a non-existent file. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to cause a user's system to     stop responding. (CVE-2017-8587)

  - A remote code execution vulnerability exists in WordPad     due to improper parsing of specially crafted files. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted file, to     execute arbitrary code in the context of the current     user. (CVE-2017-8588)

  - A remote code execution vulnerability exists in the     Windows Search component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by sending specially crafted messages     to the Windows Search service, to elevate privileges and     execute arbitrary code. (CVE-2017-8589)

  - An elevation of privilege vulnerability exists in the     Windows Common Log File System (CLFS) driver due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to run processes in an elevated context. (CVE-2017-8590)

  - A security bypass vulnerability exists in Microsoft     browsers due to improper handling of redirect requests.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to bypass CORS redirect restrictions. (CVE-2017-8592)

  - A remote code execution vulnerability exists in Internet     Explorer due to improper handling of objects in memory.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8594)

  - A spoofing vulnerability exists in Microsoft browsers     due to improper parsing of HTTP content. An     unauthenticated, remote attacker can exploit this, by     convincing a user to click a specially crafted URL, to     redirect the user to a malicious website.
    (CVE-2017-8602)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8606)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8607)

  - A remote code execution vulnerability exists in     Microsoft browsers in the JavaScript engines due to     improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a specially crafted website,     to execute arbitrary code in the context of the current     user. (CVE-2017-8608)

  - A remote code execution vulnerability exists in Internet     Explorer in the VBScript engine due to improper handling     of objects in memory. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website, to execute arbitrary code     in the context of the current user. (CVE-2017-8618)

ID	Name	Product	Family	Type	Severity
104891	Security Updates for Internet Explorer (July 2017)	Nessus	Windows : Microsoft Bulletins	Local	high
101365	Windows 8.1 and Windows Server 2012 R2 July 2017 Security Updates	Nessus	Windows : Microsoft Bulletins	Local	critical

Detections

Analytics

CVE-2017-8594

high

Tenable Plugins

high

critical