MS16-011: Cumulative Security Update for Microsoft Edge (3134225)

This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.


Synopsis :

The remote host has a web browser installed that is affected by
multiple vulnerabilities.

Description :

The version of Microsoft Edge installed on the remote host is missing
Cumulative Security Update 3134225. It is, therefore, affected by
multiple vulnerabilities :

- Multiple remote code execution vulnerabilities exist due
to improper handling of objects in memory. An attacker
can exploit these vulnerabilities by convincing a user
to visit a specially crafted website, resulting in
execution of arbitrary code in the context of the
current user. (CVE-2016-0060, CVE-2016-0061,
CVE-2016-0062, CVE-2016-0084)

- A spoofing vulnerability exists due to improper parsing
of HTTP responses. An unauthenticated, remote attacker
can exploit this, via a specially crafted URL, to
redirect a user to a malicious website. (CVE-2016-0077)

- An information disclosure vulnerability exists due to
improper handling of exceptions when dispatching certain
window messages. An unauthenticated, remote attacker can
exploit this, via a specially crafted website, to bypass
the Address Space Layout Randomization (ASLR) feature,
resulting in the ability to predict memory offsets in a
call stack. (CVE-2016-0080)

See also :

https://technet.microsoft.com/library/security/MS16-011

Solution :

Microsoft has released a set of patches for Windows 10.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Windows : Microsoft Bulletins

Nessus Plugin ID: 88643 ()

Bugtraq ID: 82629
82653
82669
82671

CVE ID: CVE-2016-0060
CVE-2016-0061
CVE-2016-0062
CVE-2016-0077
CVE-2016-0080
CVE-2016-0084

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now