Signature Detail
Short Name |
HTTP:STC:IE:8-MSHTML-INFO-DISC |
|---|---|
Severity |
Medium |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Microsoft Internet Explorer mshtml.dll Remote Information Disclosure |
Release Date |
2012/12/09 |
Update Number |
2209 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Microsoft Internet Explorer mshtml.dll Remote Information Disclosure
This signature detects attempts to exploit a known vulnerability against Microsoft Internet Explorer 8. A successful attack can lead to unauthorized info disclosure.
Extended Description
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
Affected Products
- microsoft ie 8
References
- CVE: CVE-2010-3886