Sid 1-41797

Message

BROWSER-IE Microsoft Internet Explorer loadXML parseError.errorCode information disclosure attempt

Summary

Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

Impact

CVSS base score 5.3 CVSS impact score 3.6 CVSS exploitability score 1.6 confidentialityImpact HIGH integrityImpact NONE availabilityImpact NONE

CVE-2016-3298:

CVSS base score 5.3

CVSS impact score 3.6

CVSS exploitability score 1.6

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Detailed information

CVE-2016-3298: Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

Affected systems

• microsoft internet_explorer 9
• microsoft internet_explorer 10
• microsoft internet_explorer 11
• microsoft windows_7 *
• microsoft windowsserver2008 *
• microsoft windowsserver2008 r2
• microsoft windows_vista *

Ease of attack

CVE-2016-3298:

Access Vector

Access Complexity

Authentication

False positives

None known

False negatives

None known

Corrective action

Upgrade to the latest non-affected version of the software.

Apply the appropriate vendor supplied patches.

Contributors

• Talos research team.
• This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology.
• For more information see nvd.

Additional References

• technet.microsoft.com/en-us/security/bulletin/ms16-118
• technet.microsoft.com/en-us/security/bulletin/ms16-126
• technet.microsoft.com/en-us/security/bulletin/ms17-014