MS KB2847140: Vulnerability in Internet Explorer 8 Could Allow Remote Code Execution (deprecated)

High Nessus Plugin ID 66329


The remote host is affected by a remote code execution vulnerability.


The remote host is missing one of the workarounds referenced in KB 2847140.

The remote version of IE reportedly has a use-after-free flaw related to how CGenericElement objects are handled that could result in arbitrary code execution on the remote system.

This plugin has been deprecated due to the publication of MS13-038.
Microsoft has released updates that make the workarounds unnecessary.
To check for those, use Nessus plugin ID 66413.


Apply the IE settings workarounds suggested by Microsoft in the advisory, or apply the MSHTML Shim workaround in the Microsoft 'Fix it' solution.

See Also

Plugin Details

Severity: High

ID: 66329

File Name: smb_kb2847140.nasl

Version: $Revision: 1.10 $

Type: local

Agent: windows

Family: Windows

Published: 2013/05/09

Modified: 2017/08/30

Dependencies: 13855, 49675

Risk Information

Risk Factor: High


Base Score: 9.3

Temporal Score: 8.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:W/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:ie

Required KB Items: SMB/Registry/Enumerated, SMB/WindowsVersion

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2013/05/03

Exploitable With

Core Impact

Metasploit (Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability)

Reference Information

CVE: CVE-2013-1347

BID: 59641

OSVDB: 92993

CERT: 237655

MSKB: 2847140