CVE-2017-0035
HighSummary
CVE-2017-0035 is a remote code execution vulnerability in Microsoft scripting engines that can lead to unauthorized access to the system. An attacker who successfully exploits this vulnerability can gain user rights, allowing full control if the account is administrative.
Risk Assessment
The risk to the organization involves the potential for an attacker to take control of the system, which could lead to the installation of malicious software and unauthorized access to data. The impact is particularly severe if the account has administrative privileges.
Recommendation
It is recommended to update Microsoft software to the latest version to mitigate the risk associated with this vulnerability. Additionally, implementing security policies to limit user privileges to the minimum necessary is advisable.
Other vulnerabilities in Silniki skryptowe Microsoftu
See all- CVE-2017-0151High
CVE-2017-0151 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0150High
CVE-2017-0150 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0141High
CVE-2017-0141 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0134High
CVE-2017-0134 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0133High
CVE-2017-0133 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0132High
CVE-2017-0132 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0131High
CVE-2017-0131 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0070High
CVE-2017-0070 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0067High
CVE-2017-0067 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker who successfully exploits this vulnerability could gain user rights, and if the current user has administrative rights, they could take full control of the affected system.
- CVE-2017-0015High
CVE-2017-0015 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
Original NVD description (English source)
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.