VDB-159508 · CVE-2020-1555 · GCVE-0-2020-1555

Microsoft Edge/ChakraCore Scripting Engine 内存损坏

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
7.4	$5k-$25k	0.00

摘要信息

在Microsoft Edge and ChakraCore 中曾发现分类为致命的漏洞。受此问题影响的是某些未知功能的组件:Scripting Engine。在被操纵的情况下，会引发内存损坏。该安全漏洞被称为CVE-2020-1555。远程可以启动攻击，不存在可用的漏洞利用。建议修补漏洞以消除此问题。

在Microsoft Edge and ChakraCore 中曾发现分类为致命的漏洞。受此问题影响的是某些未知功能的组件:Scripting Engine。在被操纵的情况下，会引发内存损坏。漏洞的CWE定义是 CWE-119。此漏洞的脆弱性 2020-08-11公示人类型为Security Update Guide (网站)所披露。您可以在 portal.msrc.microsoft.com 下载该通告。已与厂商就公开发布达成协调。

该安全漏洞被称为CVE-2020-1555。远程可以启动攻击，没有可用的技术细节。此漏洞的流行程度低于一般水平。不存在可用的漏洞利用。当前，大致为 USD $5k-$25k。公告内容如下：

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

若长度存在，则声明为未定义。该0day漏洞在地下市场的估算价格大约是$25k-$100k。

建议修补漏洞以消除此问题。漏洞披露后立即有可能的缓解措施被公布。