cnvd - cnvd-2019-07240

cnvd-2019-07240

Vulnerability from cnvd

Title: Microsoft Internet Explorer安全绕过漏洞（CNVD-2019-07240）

Description:

Microsoft Internet Explorer（IE）是美国微软（Microsoft）公司的一款Windows操作系统附带的Web浏览器。

Microsoft Internet Explorer 11中存在安全绕过漏洞，该漏洞源于VBScript执行策略未能正确地限制VBScript。攻击者可利用该漏洞迫使浏览器发送被限制的数据。

Severity: 中

Patch Name: Microsoft Internet Explorer安全绕过漏洞（CNVD-2019-07240）的补丁

Patch Description:

Microsoft Internet Explorer（IE）是美国微软（Microsoft）公司的一款Windows操作系统附带的Web浏览器。

Microsoft Internet Explorer 11中存在安全绕过漏洞，该漏洞源于VBScript执行策略未能正确地限制VBScript。攻击者可利用该漏洞迫使浏览器发送被限制的数据。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://portal.msrc.microsoft.com/zh-CN/security-guidance/advisory/CVE-2019-0768

Reference: http://www.securityfocus.com/bid/107279

Impacted products

Name
Microsoft Internet Explorer 11

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0768"
    }
  },
  "description": "Microsoft Internet Explorer\uff08IE\uff09\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u6b3eWindows\u64cd\u4f5c\u7cfb\u7edf\u9644\u5e26\u7684Web\u6d4f\u89c8\u5668\u3002\n\nMicrosoft Internet Explorer 11\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eVBScript\u6267\u884c\u7b56\u7565\u672a\u80fd\u6b63\u786e\u5730\u9650\u5236VBScript\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8feb\u4f7f\u6d4f\u89c8\u5668\u53d1\u9001\u88ab\u9650\u5236\u7684\u6570\u636e\u3002",
  "discovererName": "James Forshaw of Google Project Zero",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://portal.msrc.microsoft.com/zh-CN/security-guidance/advisory/CVE-2019-0768",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-07240",
  "openTime": "2019-03-13",
  "patchDescription": "Microsoft Internet Explorer\uff08IE\uff09\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u6b3eWindows\u64cd\u4f5c\u7cfb\u7edf\u9644\u5e26\u7684Web\u6d4f\u89c8\u5668\u3002\r\n\r\nMicrosoft Internet Explorer 11\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eVBScript\u6267\u884c\u7b56\u7565\u672a\u80fd\u6b63\u786e\u5730\u9650\u5236VBScript\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8feb\u4f7f\u6d4f\u89c8\u5668\u53d1\u9001\u88ab\u9650\u5236\u7684\u6570\u636e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Internet Explorer\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2019-07240\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Microsoft Internet Explorer 11"
  },
  "referenceLink": "http://www.securityfocus.com/bid/107279",
  "serverity": "\u4e2d",
  "submitTime": "2019-03-13",
  "title": "Microsoft Internet Explorer\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2019-07240\uff09"
}

CVE-2019-0768 (GCVE-0-2019-0768)

Vulnerability from cvelistv5

Published

2019-04-09 01:37

Modified

2024-08-04 17:58

Severity ?

CWE

Security Feature Bypass

Summary

A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, and to allow requests that should otherwise be ignored, aka 'Internet Explorer Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0761.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Microsoft	Internet Explorer 11	Version: Windows 10 Version 1709 for 32-bit Systems Version: Windows 10 Version 1709 for x64-based Systems Version: Windows 10 Version 1803 for 32-bit Systems Version: Windows 10 Version 1803 for x64-based Systems Version: Windows 10 Version 1803 for ARM64-based Systems Version: Windows 10 Version 1809 for 32-bit Systems Version: Windows 10 Version 1809 for x64-based Systems Version: Windows 10 Version 1809 for ARM64-based Systems Version: Windows Server 2019 Version: Windows 10 Version 1709 for ARM64-based Systems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:58:58.702Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Internet Explorer 11",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for ARM64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for ARM64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows Server 2019"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for ARM64-based Systems"
            }
          ]
        }
      ],
      "datePublic": "2019-03-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, and to allow requests that should otherwise be ignored, aka \u0027Internet Explorer Security Feature Bypass Vulnerability\u0027. This CVE ID is unique from CVE-2019-0761."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Security Feature Bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-09T01:37:38",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0768",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Internet Explorer 11",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Windows 10 Version 1709 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for ARM64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for ARM64-based Systems"
                          },
                          {
                            "version_value": "Windows Server 2019"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for ARM64-based Systems"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A security feature bypass vulnerability exists when Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, and to allow requests that should otherwise be ignored, aka \u0027Internet Explorer Security Feature Bypass Vulnerability\u0027. This CVE ID is unique from CVE-2019-0761."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Security Feature Bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0768"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-0768",
    "datePublished": "2019-04-09T01:37:38",
    "dateReserved": "2018-11-26T00:00:00",
    "dateUpdated": "2024-08-04T17:58:58.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted