Test ID:	1.3.6.1.4.1.25623.1.0.900054
Category:	Windows : Microsoft Bulletins
Title:	Cumulative Security Update for Internet Explorer (956390)
Summary:	Check for the vulnerable version of Internet Explorer
Description:	Description: MS08-058 Overview: This host is missing critical security update according to Microsoft Bulletin MS08-058. Vulnerability Insight: Multiple flaws are due to, - the browser incorrectly interpreting the origin of scripts when setting the Window location object. - the browser incorrectly interpreting the origin of scripts when handling certain HTML elements. - the browser incorrectly interpreting the origin of scripts when handling certain events. - a memory corruption error when the browser attempts to access an object which has not been initialized or has been deleted. - a memory corruption error when the browser attempts to access uninitialized memory while processing certain HTML objects. Impact: Successful exploitation could allow attackers to execute arbitrary code via a malicious web page and can gain access to a browser window in another domain leading read cookies or cross domain scripting attacks. Impact Level: System Affected Software/OS: Internet Explorer 5.01 & 6 on MS Windows 2000 Internet Explorer 6 on MS Windows 2003 and XP Internet Explorer 7 on MS Windows 2003 and XP Internet Explorer 7 on MS Windows 2008 and Vista Fix: Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link, http://www.microsoft.com/technet/security/bulletin/ms08-058.mspx References: http://www.microsoft.com/technet/security/bulletin/ms08-058.mspx CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	BugTraq ID: 29960 BugTraq ID: 31615 BugTraq ID: 31616 BugTraq ID: 31617 BugTraq ID: 31618 BugTraq ID: 31654 Common Vulnerability Exposure (CVE) ID: CVE-2008-2947 http://blogs.zdnet.com/security/?p=1348 http://www.ph4nt0m.org-a.googlepages.com/PSTZine_0x02_0x04.txt HPdes Security Advisory: HPSBST02379 http://marc.info/?l=bugtraq&m=122479227205998&w=2 HPdes Security Advisory: SSRT080143 Microsoft Security Bulletin: MS08-058 http://www.microsoft.com/technet/security/Bulletin/MS08-058.mspx Cert/CC Advisory: TA08-288A http://www.us-cert.gov/cas/techalerts/TA08-288A.html CERT/CC vulnerability note: VU#923508 http://www.kb.cert.org/vuls/id/923508 http://www.securityfocus.com/bid/29960 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5901 http://www.vupen.com/english/advisories/2008/1940/references http://www.vupen.com/english/advisories/2008/2809 http://www.securitytracker.com/id?1020382 http://secunia.com/advisories/30857 XForce ISS Database: ie-location-locationhref-security-bypass(43366) http://xforce.iss.net/xforce/xfdb/43366 XForce ISS Database: win-ms08kb956390-update(45565) http://xforce.iss.net/xforce/xfdb/45565 Common Vulnerability Exposure (CVE) ID: CVE-2008-3472 http://www.securityfocus.com/bid/31615 http://www.securityfocus.com/bid/31654 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12364 http://www.securitytracker.com/id?1021047 XForce ISS Database: ie-element-security-bypass(45558) http://xforce.iss.net/xforce/xfdb/45558 Common Vulnerability Exposure (CVE) ID: CVE-2008-3473 http://www.securityfocus.com/bid/31616 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13255 XForce ISS Database: ie-event-security-bypass(45562) http://xforce.iss.net/xforce/xfdb/45562 Common Vulnerability Exposure (CVE) ID: CVE-2008-3474 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13299 XForce ISS Database: ie-script-origin-information-disclosure(45854) http://xforce.iss.net/xforce/xfdb/45854 Common Vulnerability Exposure (CVE) ID: CVE-2008-3475 Bugtraq: 20081015 Internet Explorer 6 componentFromPoint() remote memory disclosure and remote code execution (Google Search) http://www.securityfocus.com/archive/1/archive/1/497380/100/0/threaded http://ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html http://www.zerodayinitiative.com/advisories/ZDI-08-069/ http://www.securityfocus.com/bid/31617 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13151 XForce ISS Database: ie-uninitialized-objects-code-execution(45563) http://xforce.iss.net/xforce/xfdb/45563 Common Vulnerability Exposure (CVE) ID: CVE-2008-3476 http://www.securityfocus.com/bid/31618 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13344 XForce ISS Database: ie-unit-memory-code-execution(45564) http://xforce.iss.net/xforce/xfdb/45564
Copyright	Copyright (C) 2008 SecPod

This is only one of 56160 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: