Microsoft Internet Explorer 9/10/11 Security Feature permission assignment

Summaryinfo

A vulnerability has been found in Microsoft Internet Explorer 9/10/11 and classified as critical. This issue affects some unknown processing of the component Security Feature. Performing a manipulation results in permission assignment. This vulnerability is known as CVE-2019-1220. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Microsoft Internet Explorer 9/10/11 (Web Browser). It has been classified as critical. This affects an unknown part of the component Security Feature. The manipulation with an unknown input leads to a permission assignment vulnerability. CWE is classifying the issue as CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security Feature Bypass Vulnerability'.

The weakness was published 09/10/2019 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The public release has been coordinated with Microsoft. This vulnerability is uniquely identified as CVE-2019-1220 since 11/26/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/19/2020). It is expected to see the exploit prices for this product decreasing in the near future. The advisory points out:

A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs. This could allow an attacker to cause a user to access a URL in a less restricted Internet Security Zone than intended.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entry is available at VDB-141584. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Microsoft

Name

• Internet Explorer

Version

• 9
• 10
• 11

License

• commercial

Support

• end of life

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion