CVE-2013-7331: Microsoft Internet Explorer Information Disclosure Vulnerability
First published: Wed Feb 26 2014(Updated: )
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Explorer | =6 | |
| Microsoft Windows Server 2003 | =sp2 | |
| Microsoft Internet Explorer | =7 | |
| Microsoft Windows Server 2008 | =sp2 | |
| Microsoft Windows Vista | =sp2 | |
| Microsoft Internet Explorer | =8 | |
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows Server 2008 | =r2-sp1 | |
| Microsoft Windows Server 2008 | =r2-sp1 | |
| Microsoft Internet Explorer | =9 | |
| Microsoft Internet Explorer | =10 | |
| Microsoft Windows 8 | ||
| Microsoft Windows Rt | ||
| Microsoft Windows Server 2012 | ||
| Microsoft Internet Explorer | =11 | |
| Microsoft Windows 8.1 | ||
| Microsoft Windows RT 8.1 | ||
| Microsoft Windows Server 2012 | =r2 | |
| Microsoft Internet Explorer | ||
| All of | ||
| Microsoft Internet Explorer | =6 | |
| Microsoft Windows Server 2003 | =sp2 | |
| All of | ||
| Microsoft Internet Explorer | =7 | |
| Any of | ||
| Microsoft Windows Server 2003 | =sp2 | |
| Microsoft Windows Server 2008 | =sp2 | |
| Microsoft Windows Vista | =sp2 | |
| All of | ||
| Microsoft Internet Explorer | =8 | |
| Any of | ||
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows Server 2003 | =sp2 | |
| Microsoft Windows Server 2008 | =sp2 | |
| Microsoft Windows Server 2008 | =r2-sp1 | |
| Microsoft Windows Server 2008 | =r2-sp1 | |
| Microsoft Windows Vista | =sp2 | |
| All of | ||
| Microsoft Internet Explorer | =9 | |
| Any of | ||
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows Server 2008 | =sp2 | |
| Microsoft Windows Server 2008 | =r2-sp1 | |
| Microsoft Windows Vista | =sp2 | |
| All of | ||
| Microsoft Internet Explorer | =10 | |
| Any of | ||
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows 8 | ||
| Microsoft Windows Rt | ||
| Microsoft Windows Server 2008 | =r2-sp1 | |
| Microsoft Windows Server 2012 | ||
| Microsoft Windows Vista | =sp2 | |
| All of | ||
| Microsoft Internet Explorer | =11 | |
| Any of | ||
| Microsoft Windows 7 | =sp1 | |
| Microsoft Windows 8.1 | ||
| Microsoft Windows RT 8.1 | ||
| Microsoft Windows Server 2008 | =r2-sp1 | |
| Microsoft Windows Server 2012 | =r2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html
- http://www.kb.cert.org/vuls/id/539289
- http://www.securitytracker.com/id/1030818
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052
- https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/
- https://nvd.nist.gov/vuln/detail/CVE-2013-7331
- agent/type
- agent/first-publish-date
- agent/description
- agent/title
- agent/severity
- agent/weakness
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/author
- agent/event
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- agent/last-modified-date
- agent/tags
- agent/trending
- vendor/microsoft
- canonical/microsoft internet explorer
- version/microsoft internet explorer/6
- canonical/microsoft windows server 2003
- version/microsoft windows server 2003/sp2
- version/microsoft internet explorer/7
- canonical/microsoft windows server 2008
- version/microsoft windows server 2008/sp2
- canonical/microsoft windows vista
- version/microsoft windows vista/sp2
- version/microsoft internet explorer/8
- canonical/microsoft windows 7
- version/microsoft windows 7/sp1
- version/microsoft windows server 2008/r2-sp1
- version/microsoft internet explorer/9
- version/microsoft internet explorer/10
- canonical/microsoft windows 8
- canonical/microsoft windows rt
- canonical/microsoft windows server 2012
- version/microsoft internet explorer/11
- canonical/microsoft windows 8.1
- canonical/microsoft windows rt 8.1
- version/microsoft windows server 2012/r2