CVE-2020-1380— Microsoft Internet Explorer 缓冲区错误漏洞
一分钟漏洞结论
影响对象
Microsoft Internet Explorer 11
利用判断
已确认在野利用，应立即处置
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Microsoft Internet Explorer（IE）是美国微软（Microsoft）公司的一款Windows操作系统附带的Web浏览器。 Microsoft IE 11版本中Scripting Engine处理内存的方式存在缓冲区错误漏洞。攻击者可借助特制网站利用该漏洞在当前用户上下文中执行任意代码，损坏内存。
已观察到在野利用
cisa_kev · confirmed
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2020-1380 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Scripting Engine Memory Corruption Vulnerability
来源: CVE Program / CVE List V5
Vulnerability Description
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.
The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Microsoft Internet Explorer 缓冲区错误漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Microsoft Internet Explorer（IE）是美国微软（Microsoft）公司的一款Windows操作系统附带的Web浏览器。 Microsoft IE 11版本中Scripting Engine处理内存的方式存在缓冲区错误漏洞。攻击者可借助特制网站利用该漏洞在当前用户上下文中执行任意代码，损坏内存。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Microsoft | Internet Explorer 11 | 1.0.0 ~ publication |
cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*
|
|
二、漏洞 CVE-2020-1380 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2020-1380 的情报信息
请登录查看更多情报信息。
CVE-2020-1380 厂商安全公告 (1)
CVE-2020-1380 公开利用代码 (1)
同批安全公告 · Microsoft · 2020-08-17 · 共 121 条
| CVE-2020-1467 | 10.0 CRITICAL | Microsoft Windows和Windows Server 安全漏洞 |
| CVE-2020-1583 | 8.8 HIGH | Microsoft Word 信息泄露漏洞 |
| CVE-2020-1504 | 8.8 HIGH | Microsoft Excel 缓冲区错误漏洞 |
| CVE-2020-1552 | 8.0 HIGH | Microsoft Windows Work Folder Service 缓冲区错误漏洞 |
| CVE-2020-1521 | 7.8 HIGH | Microsoft Windows Speech Runtime 安全漏洞 |
| CVE-2020-1534 | 7.8 HIGH | Microsoft Windows Backup Service 安全漏洞 |
| CVE-2020-1533 | 7.8 HIGH | Microsoft Windows WalletService 缓冲区错误漏洞 |
| CVE-2020-1531 | 7.8 HIGH | Microsoft Windows Accounts Control 缓冲区错误漏洞 |
| CVE-2020-1530 | 7.8 HIGH | Microsoft Windows Remote Access 缓冲区错误漏洞 |
| CVE-2020-1529 | 7.8 HIGH | Microsoft Windows Graphics Device Interface 缓冲区错误漏洞 |
| CVE-2020-1528 | 7.8 HIGH | Microsoft Windows Radio Manager API 缓冲区错误漏洞 |
| CVE-2020-1527 | 7.8 HIGH | Microsoft Windows Custom Protocol Engine 缓冲区错误漏洞 |
| CVE-2020-1526 | 7.8 HIGH | Microsoft Windows Network Connection Broker 安全漏洞 |
| CVE-2020-1525 | 7.8 HIGH | Microsoft Media Foundation 缓冲区错误漏洞 |
| CVE-2020-1524 | 7.8 HIGH | Microsoft Windows Speech Shell 安全漏洞 |
| CVE-2020-1513 | 7.8 HIGH | Microsoft Windows CSC Service 安全漏洞 |
| CVE-2020-1516 | 7.8 HIGH | Microsoft Windows Work Folders Service 安全漏洞 |
| CVE-2020-1515 | 7.8 HIGH | Microsoft Windows Telephony Server 安全漏洞 |
| CVE-2020-1517 | 7.8 HIGH | Microsoft Windows File Server Resource Management Service 安全漏洞 |
| CVE-2020-1512 | 7.8 HIGH | Microsoft Windows State Repository Service 信息泄露漏洞 |
显示前 20 条，共 121 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2020-1380
暂无评论