CVE-2016-3353
Microsoft Windows .URL File Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Microsoft Internet Explorer 9 through 11 mishandles .url files from the Internet zone, which allows remote attackers to bypass intended access restrictions via a crafted file, aka "Internet Explorer Security Feature Bypass."
Microsoft Internet Explorer 9 hasta la versión 11 no maneja adecuadamente archivos .url de la zona de Internet, lo que permite a atacantes remotos eludir restricciones destinadas al acceso a través de un archivo manipulado, vulnerabilidad también conocida como "Internet Explorer Security Feature Bypass".
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
An attacker can craft a malicious file with a .URL extension. If the victim opens the .URL file, the attacker can execute arbitrary code on the victim's machine under the context of the user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-03-15 CVE Reserved
- 2016-09-14 CVE Published
- 2024-08-05 CVE Updated
- 2024-11-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-254: 7PK - Security Features
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/92827 | Vdb Entry | |
| http://www.securitytracker.com/id/1036788 | Vdb Entry | |
| http://zerodayinitiative.com/advisories/ZDI-16-506 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-104 | 2018-10-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 9 Search vendor "Microsoft" for product "Internet Explorer" and version "9" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 10 Search vendor "Microsoft" for product "Internet Explorer" and version "10" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 11 Search vendor "Microsoft" for product "Internet Explorer" and version "11" | - |
Affected
| ||||||