cnvd - cnvd-2016-12414

CNVD-2016-12414

Vulnerability from cnvd - Published: 2016-12-16

Title

Microsoft Internet Explorer和Edge安全绕过漏洞

Description

Microsoft Internet Explorer是Windows 10之前操作系统附带的默认浏览器，Microsoft Edge是最新操作系统Windows 10附带的默认浏览器。 Microsoft Internet Explorer 10和11版本和Edge中存在安全绕过漏洞，该漏洞源于程序无法对在Web Workers中运行的脚本正确应用同源策略。攻击者可借助恶意的网页利用该漏洞绕过安全保护。

Severity

中

Patch Name

Microsoft Internet Explorer和Edge安全绕过漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://technet.microsoft.com/library/security/ms16-145

Reference

https://technet.microsoft.com/library/security/ms16-145

Impacted products

Name
['Microsoft Internet Explorer 10', 'Microsoft Internet Explorer 11', 'Microsoft Edge']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-7281"
    }
  },
  "description": "Microsoft Internet Explorer\u662fWindows 10\u4e4b\u524d\u64cd\u4f5c\u7cfb\u7edf\u9644\u5e26\u7684\u9ed8\u8ba4\u6d4f\u89c8\u5668\uff0cMicrosoft Edge\u662f\u6700\u65b0\u64cd\u4f5c\u7cfb\u7edfWindows 10\u9644\u5e26\u7684\u9ed8\u8ba4\u6d4f\u89c8\u5668\u3002 \r\n\r\nMicrosoft Internet Explorer 10\u548c11\u7248\u672c\u548cEdge\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u65e0\u6cd5\u5bf9\u5728Web Workers\u4e2d\u8fd0\u884c\u7684\u811a\u672c\u6b63\u786e\u5e94\u7528\u540c\u6e90\u7b56\u7565\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u7f51\u9875\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u4fdd\u62a4\u3002",
  "discovererName": "Microsoft",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://technet.microsoft.com/library/security/ms16-145",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-12414",
  "openTime": "2016-12-16",
  "patchDescription": "Microsoft Internet Explorer\u662fWindows 10\u4e4b\u524d\u64cd\u4f5c\u7cfb\u7edf\u9644\u5e26\u7684\u9ed8\u8ba4\u6d4f\u89c8\u5668\uff0cMicrosoft Edge\u662f\u6700\u65b0\u64cd\u4f5c\u7cfb\u7edfWindows 10\u9644\u5e26\u7684\u9ed8\u8ba4\u6d4f\u89c8\u5668\u3002 \r\n\r\nMicrosoft Internet Explorer 10\u548c11\u7248\u672c\u548cEdge\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u65e0\u6cd5\u5bf9\u5728Web Workers\u4e2d\u8fd0\u884c\u7684\u811a\u672c\u6b63\u786e\u5e94\u7528\u540c\u6e90\u7b56\u7565\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u7f51\u9875\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u4fdd\u62a4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Internet Explorer\u548cEdge\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Internet Explorer 10",
      "Microsoft Internet Explorer 11",
      "Microsoft Edge"
    ]
  },
  "referenceLink": "https://technet.microsoft.com/library/security/ms16-145",
  "serverity": "\u4e2d",
  "submitTime": "2016-12-14",
  "title": "Microsoft Internet Explorer\u548cEdge\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2016-7281 (GCVE-0-2016-7281)

Vulnerability from cvelistv5 – Published: 2016-12-20 05:54 – Updated: 2024-08-06 01:57

Summary

The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Browser Security Feature Bypass Vulnerability."

Severity ?

No CVSS data available.

CWE

Assigner

microsoft

References

URL

Tags

	https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS
	http://www.securitytracker.com/id/1037444	vdb-entryx_refsource_SECTRACK
	http://www.securityfocus.com/bid/94723	vdb-entryx_refsource_BID
	https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:57:47.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MS16-144",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144"
          },
          {
            "name": "1037444",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037444"
          },
          {
            "name": "94723",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94723"
          },
          {
            "name": "MS16-145",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-12-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka \"Microsoft Browser Security Feature Bypass Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "MS16-144",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144"
        },
        {
          "name": "1037444",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037444"
        },
        {
          "name": "94723",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94723"
        },
        {
          "name": "MS16-145",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2016-7281",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka \"Microsoft Browser Security Feature Bypass Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MS16-144",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144"
            },
            {
              "name": "1037444",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037444"
            },
            {
              "name": "94723",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94723"
            },
            {
              "name": "MS16-145",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2016-7281",
    "datePublished": "2016-12-20T05:54:00",
    "dateReserved": "2016-09-09T00:00:00",
    "dateUpdated": "2024-08-06T01:57:47.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-12414

CVE-2016-7281 (GCVE-0-2016-7281)

Tags

Sightings

Nomenclature