CVE-2017-0059
Microsoft Internet Explorer Information Disclosure Vulnerability
Description
CVE-2017-0059 is an information disclosure vulnerability in Microsoft Internet Explorer that allows a remote attacker to obtain sensitive information about the user's system by tricking them into visiting a specially crafted webpage. The vulnerability exists in the way Internet Explorer handles objects in memory, enabling an attacker to read portions of memory that may contain sensitive data such as memory layout information useful for bypassing ASLR. CISA added CVE-2017-0059 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming active exploitation. With an EPSS score of 95.5% (99.7th percentile), this vulnerability is extensively exploited, often as a reconnaissance step in browser exploit chains.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | internet explorer | 9; 10; 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
- http://www.securityfocus.com/bid/96645(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038008(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0059(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/41661/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42354/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/43125/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0059(US Government Resource)
Weakness Type
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes a weakness where software exposes sensitive information to actors not authorized to access it, potentially aiding further attacks. In CVE-2017-0059, Internet Explorer improperly handles objects in memory, leaking memory contents to a remote attacker through a crafted webpage, providing information that can be used to bypass memory protection mechanisms like ASLR.
Learn more: CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
Impact Analysis
CVE-2017-0059 enables remote information disclosure through Internet Explorer, allowing an attacker to read sensitive memory contents from the browser process by luring a user to a malicious webpage. The primary impact is the leakage of memory layout information that can be used to defeat Address Space Layout Randomization (ASLR), a critical exploit mitigation technique. By itself, the information disclosure does not grant code execution, but it is frequently chained with separate memory corruption vulnerabilities to achieve reliable remote code execution. The 99.7th percentile EPSS score confirms that this vulnerability is actively used as a building block in sophisticated browser exploit chains targeting Internet Explorer users.
Exploit Maturity
CVE-2017-0059 is confirmed as actively exploited in the wild by CISA through its KEV catalog listing on March 28, 2022. The EPSS score of 95.5% (99.7th percentile) reflects extremely high exploitation probability, consistent with its documented use as an ASLR bypass component in multi-vulnerability browser exploit chains. Information disclosure vulnerabilities of this nature are highly valued by exploit developers because they provide the memory layout knowledge needed to make code execution exploits reliable across different system configurations.
Remediation
- Apply the Microsoft security update from March 2017 (Patch Tuesday) that addresses CVE-2017-0059 in Internet Explorer across all affected versions.
- Migrate users away from Internet Explorer to a modern, actively maintained browser such as Microsoft Edge or Google Chrome, as Internet Explorer has reached end of life.
- If Internet Explorer must be retained for legacy application compatibility, configure it with the highest security zone settings and restrict internet browsing through IE to only trusted internal sites.
- Deploy network-level web filtering to block access to known malicious domains that serve browser exploit kits targeting Internet Explorer vulnerabilities.
Technical Details
CVE-2017-0059 is an information disclosure vulnerability in Microsoft Internet Explorer caused by improper handling of objects in memory during page rendering. When Internet Explorer processes certain crafted HTML or JavaScript content, it fails to properly initialize or protect memory regions, allowing an attacker to read the contents of uninitialized or adjacent memory through carefully constructed page elements. The leaked information typically includes memory addresses and object pointers that reveal the memory layout of the browser process, enabling an attacker to calculate the base addresses of loaded modules and defeat ASLR. This makes the vulnerability particularly valuable as a prerequisite for reliable exploitation of separate memory corruption bugs in IE.
Frequently Asked Questions
Is CVE-2017-0059 being actively exploited?
Yes, CVE-2017-0059 is confirmed as actively exploited in the wild by CISA. The EPSS score of 95.5% (99.7th percentile) confirms extremely high exploitation activity. The vulnerability is commonly used as an ASLR bypass in browser exploit chains targeting Internet Explorer.
What products are affected by CVE-2017-0059?
CVE-2017-0059 affects Microsoft Internet Explorer 9, 10, and 11 across multiple Windows versions. Any system still running Internet Explorer without the March 2017 security update is vulnerable.
How do I fix CVE-2017-0059?
Apply the Microsoft security update from March 2017 that addresses CVE-2017-0059. Ideally, migrate away from Internet Explorer entirely to a modern browser, as IE has reached end of life and no longer receives security updates.
How severe is CVE-2017-0059?
CVE-2017-0059 is a high-severity information disclosure vulnerability with an EPSS score in the 99.7th percentile. While it does not directly enable code execution, it is a critical component in browser exploit chains, providing ASLR bypass information that makes companion code execution exploits reliable and effective.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.