Описание
Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website designed to exploit the vulnerability through a Microsoft browser and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the browser rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.
Обходное решение
Restrict access to VBScript.dll and JScript.dll For 32-bit systems, enter the following command at an administrative command prompt:
For 64-bit systems, enter the following command at an administrative command prompt:
Impact of Workaround. Websites that use VBScript or JScript may not work properly.
How to undo the workaround. For 32-bit systems, enter the following command at an administrative command prompt:
For 64-bit systems, enter the following command at an administrative command prompt:
FAQ
For my particular system and Internet Explorer configuration, which update addresses the vulnerabilities discussed in CVE-2016-3205, CVE-2016-3206, or CVE-2016-3207? CVE-2016-3205, CVE-2016-3206, and CVE-2016-3207 are vulnerabilities in the VBScript engine. Although the attack vector is through Internet Explorer, the vulnerability is addressed by the updates released in this bulletin (MS16-063) for systems running Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. For Internet Explorer 7 and earlier, the vulnerabilities are addressed by the updates described in MS16-069.
**Once I know the version of the JScript or VBScript scripting engine installed on my system, where do I get the update? ** The affected software in this bulletin apply to systems running Internet Explorer 7 or earlier. Customers with systems running Internet Explorer 8 or later should apply the Internet Explorer Cumulative Update (MS16-063), which also addresses the vulnerabilities discussed in this bulletin.
Why do I see both JScript.dll and VBScript.dll in the packages for this cumulative security update? This security update ships as a cumulative update for the JScript and VBScript scripting engines. While both engines are included in this release, the components affected by the security fixes covered by this bulletin are listed above in the section Affected Software.
How do I determine which versions of JScript and VBScript scripting engines are installed on my system? The JScript and VBScript scripting engines are installed with supported releases of Microsoft Windows. In addition, installing a newer version of Internet Explorer on a system can change the versions of the JScript and VBScript scripting engines that are installed. To determine which versions of the JScript or VBScript scripting engines are installed on your system, perform the following steps:
- Open Windows Explorer.
- Navigate to the %systemroot%\system32 directory.
- For VBScript, right-click vbscript.dll, select Properties, and then click the Details tab.
- For JScript, right-click jscript.dll, select Properties, and then click the Details tab.
The version number is listed in the File Version field. If your file version starts with 5.8, for example 5.8.7600.16385, then VBScript 5.8 is installed on your system.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| VBScript 5.7 on Windows Vista Service Pack 2 | ||
| VBScript 5.7 on Windows Vista x64 Edition Service Pack 2 | ||
| VBScript 5.7 on Windows Server 2008 for 32-bit Systems Service Pack 2 | ||
| VBScript 5.7 on Windows Server 2008 for x64-based Systems Service Pack 2 | ||
| VBScript 5.7 on Windows Server 2008 for Itanium-Based Systems Service Pack 2 | ||
| VBScript 5.7 on Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | ||
| VBScript 5.7 on Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | ||
| VBScript 5.8 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | ||
| Internet Explorer 10 on Windows Server 2012 | ||
| Internet Explorer 11 on Windows 8.1 for 32-bit systems |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
Older Software Release
DOS
EPSS
Связанные уязвимости
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3206 and CVE-2016-3207.
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3206 and CVE-2016-3207.
EPSS