CVE-2017-0067
HighSummary
CVE-2017-0067 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker who successfully exploits this vulnerability could gain user rights, and if the current user has administrative rights, they could take full control of the affected system.
Risk Assessment
The organization is at significant risk as an attacker could install programs, view, change, or delete data, and create new accounts with full user rights. If exploited by a user with administrative privileges, the consequences could be catastrophic.
Recommendation
It is recommended to immediately apply available security patches from Microsoft and monitor systems for unauthorized activity. Additionally, it is advisable to limit user permissions to the minimum necessary.
Other vulnerabilities in Silniki skryptowe Microsoftu
See all- CVE-2017-0151High
CVE-2017-0151 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0150High
CVE-2017-0150 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0141High
CVE-2017-0141 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0134High
CVE-2017-0134 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0133High
CVE-2017-0133 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0132High
CVE-2017-0132 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0131High
CVE-2017-0131 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0070High
CVE-2017-0070 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0035High
CVE-2017-0035 is a remote code execution vulnerability in Microsoft scripting engines that can lead to unauthorized access to the system. An attacker who successfully exploits this vulnerability can gain user rights, allowing full control if the account is administrative.
- CVE-2017-0015High
CVE-2017-0015 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
Original NVD description (English source)
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.