Sid 1-41763

Rule Documentation
References

Rule Category

BROWSER-IE -- Snort has detected traffic known to exploit vulnerabilities present in the Internet Explorer browser, or products that have the Trident or Tasman engines.

Alert Message

BROWSER-IE Microsoft Edge HandleColumnBreakOnColumnSpanningElement type confusion attempt

Rule Explanation

This event is generated when a type confusion attack is detected in Microsoft Edge. Impact: Attempted Administrator Privilege Gain Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2017-0037

Rule Vulnerability

CVE Additional Information

CVE-2017-0037

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

Details
Severity		Base Score	8.1
Impact Score	5.9	Exploit Score	2.2
Confidentiality Impact	HIGH	Integrity Impact	HIGH
Availability Impact	HIGH	Access Vector
Authentication		Ease of Access