CVE-2011-1345 - Vulnerability Details - OpenCVE

Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011, aka "Object Management Memory Corruption Vulnerability."

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Internet Explorer Windows 7

Configuration 1 [-]

AND

cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
http://twitter.com/aaronportnoy/statuses/45642180118855680
http://twitter.com/msftsecresponse/statuses/45646985998516224
http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own
http://www.securityfocus.com/bid/46821
http://www.securitytracker.com/id?1025327
http://www.us-cert.gov/cas/techalerts/TA11-102A.html
http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018
https://exchange.xforce.ibmcloud.com/vulnerabilities/66062
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228
https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2011-03-10T20:00:00

Updated: 2024-08-06T22:21:34.720Z

Reserved: 2011-03-10T00:00:00

Link: CVE-2011-1345

Vulnrichment

No data.

NVD

Status : Modified

Published: 2011-03-10T20:55:01.313

Modified: 2024-11-21T01:26:07.663

Link: CVE-2011-1345

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-03-10T00:00:00", "descriptions": [{"lang": "en", "value": "Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011, aka \"Object Management Memory Corruption Vulnerability.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-12T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "TA11-102A", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "http://www.us-cert.gov/cas/techalerts/TA11-102A.html"}, {"tags": ["x_refsource_MISC"], "url": "http://twitter.com/msftsecresponse/statuses/45646985998516224"}, {"tags": ["x_refsource_MISC"], "url": "http://twitter.com/aaronportnoy/statuses/45642180118855680"}, {"name": "1025327", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1025327"}, {"name": "MS11-018", "tags": ["vendor-advisory", "x_refsource_MS"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018"}, {"tags": ["x_refsource_MISC"], "url": "http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011"}, {"tags": ["x_refsource_MISC"], "url": "http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own"}, {"name": "46821", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/46821"}, {"name": "oval:org.mitre.oval:def:12228", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228"}, {"tags": ["x_refsource_MISC"], "url": "https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011"}, {"name": "ms-ie-unspec-code-exec(66062)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66062"}, {"tags": ["x_refsource_MISC"], "url": "http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2011-1345", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011, aka \"Object Management Memory Corruption Vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "TA11-102A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA11-102A.html"}, {"name": "http://twitter.com/msftsecresponse/statuses/45646985998516224", "refsource": "MISC", "url": "http://twitter.com/msftsecresponse/statuses/45646985998516224"}, {"name": "http://twitter.com/aaronportnoy/statuses/45642180118855680", "refsource": "MISC", "url": "http://twitter.com/aaronportnoy/statuses/45642180118855680"}, {"name": "1025327", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1025327"}, {"name": "MS11-018", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018"}, {"name": "http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011", "refsource": "MISC", "url": "http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011"}, {"name": "http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own", "refsource": "MISC", "url": "http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own"}, {"name": "46821", "refsource": "BID", "url": "http://www.securityfocus.com/bid/46821"}, {"name": "oval:org.mitre.oval:def:12228", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228"}, {"name": "https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011", "refsource": "MISC", "url": "https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011"}, {"name": "ms-ie-unspec-code-exec(66062)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66062"}, {"name": "http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367", "refsource": "MISC", "url": "http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T22:21:34.720Z"}, "title": "CVE Program Container", "references": [{"name": "TA11-102A", "tags": ["third-party-advisory", "x_refsource_CERT", "x_transferred"], "url": "http://www.us-cert.gov/cas/techalerts/TA11-102A.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://twitter.com/msftsecresponse/statuses/45646985998516224"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://twitter.com/aaronportnoy/statuses/45642180118855680"}, {"name": "1025327", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1025327"}, {"name": "MS11-018", "tags": ["vendor-advisory", "x_refsource_MS", "x_transferred"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own"}, {"name": "46821", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/46821"}, {"name": "oval:org.mitre.oval:def:12228", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011"}, {"name": "ms-ie-unspec-code-exec(66062)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66062"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2011-1345", "datePublished": "2011-03-10T20:00:00", "dateReserved": "2011-03-10T00:00:00", "dateUpdated": "2024-08-06T22:21:34.720Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*", "matchCriteriaId": "A52E757F-9B41-43B4-9D67-3FEDACA71283", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*", "matchCriteriaId": "D56B932B-9593-44E2-B610-E4EB2143EB21", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011, aka \"Object Management Memory Corruption Vulnerability.\""}, {"lang": "es", "value": "Vulnerabilidad sin especificar en Microsoft Internet Explorer 8 en Windows 7 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores de ataque desconocidos, como ha demostrado Stephen Fewer con la primera de las tres vulnerabilidades encadenadas durante el concurso Pwn2Own en la CanSecWest 2011."}], "id": "CVE-2011-1345", "lastModified": "2024-11-21T01:26:07.663", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2011-03-10T20:55:01.313", "references": [{"source": "cve@mitre.org", "url": "http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011"}, {"source": "cve@mitre.org", "url": "http://twitter.com/aaronportnoy/statuses/45642180118855680"}, {"source": "cve@mitre.org", "url": "http://twitter.com/msftsecresponse/statuses/45646985998516224"}, {"source": "cve@mitre.org", "url": "http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/46821"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1025327"}, {"source": "cve@mitre.org", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA11-102A.html"}, {"source": "cve@mitre.org", "url": "http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367"}, {"source": "cve@mitre.org", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66062"}, {"source": "cve@mitre.org", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228"}, {"source": "cve@mitre.org", "url": "https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://twitter.com/aaronportnoy/statuses/45642180118855680"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://twitter.com/msftsecresponse/statuses/45646985998516224"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/46821"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1025327"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA11-102A.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66062"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}