← Volver a CVEs

CVE-2013-3918

HIGHCISA KEV

8.8

Descripcion

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado11/12/2013

Ultima modificacion4/22/2026

Fuentekev

Avistamientos honeypot0

CISA KEV

VendedorMicrosoft

ProductoWindows

Nombre vulnerabilidadMicrosoft Windows Out-of-Bounds Write Vulnerability

Fecha inclusion KEV2025-10-06

Fecha limite remediacion2025-10-27

Uso en ransomwareUnknown

Productos afectados

microsoft:windows_7microsoft:windows_8microsoft:windows_8.1microsoft:windows_rtmicrosoft:windows_rt_8.1microsoft:windows_server_2003microsoft:windows_server_2008microsoft:windows_server_2012microsoft:windows_vistamicrosoft:windows_xp

Debilidades (CWE)

CWE-787CWE-787

Referencias

http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx(secure@microsoft.com)

http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814/(secure@microsoft.com)

http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.html(secure@microsoft.com)

http://www.us-cert.gov/ncas/alerts/TA13-317A(secure@microsoft.com)

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090(secure@microsoft.com)

https://isc.sans.edu/forums/diary/16985(secure@microsoft.com)

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19089(secure@microsoft.com)

http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-addressed-in-update-tuesday.aspx(af854a3a-2127-422b-91ae-364da2661108)

http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild-s/240163814/(af854a3a-2127-422b-91ae-364da2661108)

http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering-hole-attack.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.us-cert.gov/ncas/alerts/TA13-317A(af854a3a-2127-422b-91ae-364da2661108)

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090(af854a3a-2127-422b-91ae-364da2661108)

https://isc.sans.edu/forums/diary/16985(af854a3a-2127-422b-91ae-364da2661108)

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19089(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3918(134c704f-9b21-4f2e-91b3-4a467353bcc0)

https://www.microsoft.com/en-us/msrc/blog/2013/11/technical-details-of-the-targeted-attack-using-ie-vulnerability-cve-2013-3918/(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.