CVE-2013-3918

KEV

Published: Nov 12, 2013 Last Modified: Ott 22, 2025

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: required

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

HIGH 9,3

Source: [email protected]

Access Vector: network

Access Complexity: medium

Authentication: none

Confidentiality: complete

Integrity: complete

Availability: complete

Description

AI Translation Available

The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka 'InformationCardSigninHelper Vulnerability.'

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,8610

Percentile

1,0th

Updated

EPSS Score Trend (Last 90 Days)

119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Stable

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Confidentiality Availability

Potential Impacts:

Execute Unauthorized Code Or Commands Modify Memory Read Memory Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory)

Applicable Platforms

Languages: Assembly, C, C++, Memory-Unsafe

Likelihood of Exploit: High

View CWE Details

787

Out-of-bounds Write

Draft

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Availability Other

Potential Impacts:

Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Unexpected State

Applicable Platforms

Languages: Assembly, C, C++, Memory-Unsafe

Technologies: ICS/OT

Likelihood of Exploit: High

View CWE Details

Exploit

Microsoft Internet Explorer - CardSpaceClaimCollection ActiveX Integer Underflow …

Verified Metasploit Framework (MSF)

Microsoft Internet Explorer - CardSpaceClaimCollection ActiveX Integer Underflow (MS13-090) (Metasploit)

Author: Metasploit Published: Status: Verified

View Exploit Code →

Operating System

Windows 8 by Microsoft

Product Information

Vendor Microsoft

Product Windows 8

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2003 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2003

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2008 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2008

Version sp2

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2008:sp2:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows 7 by Microsoft

Product Information

Vendor Microsoft

Product Windows 7

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2012 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2012

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Rt by Microsoft

Product Information

Vendor Microsoft

Product Windows Rt

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2008 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2008

Version r2

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2008 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2008

Version r2

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Vista by Microsoft

Product Information

Vendor Microsoft

Product Windows Vista

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Xp by Microsoft

Product Information

Vendor Microsoft

Product Windows Xp

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Rt 8.1 by Microsoft

Product Information

Vendor Microsoft

Product Windows Rt 8.1

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Xp by Microsoft

Product Information

Vendor Microsoft

Product Windows Xp

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows Server 2012 by Microsoft

Product Information

Vendor Microsoft

Product Windows Server 2012

Version r2

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Operating System

Windows 8.1 by Microsoft

Product Information

Vendor Microsoft

Product Windows 8.1

Version -

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

https://www.cisa.gov/known-exploited-vulnerabilities-catalo…

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013…

https://www.microsoft.com/en-us/msrc/blog/2013/11/technical…

https://www.microsoft.com/en-us/msrc/blog/2013/11/technical-details-of-the-targ…

http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-…

http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-…

https://docs.microsoft.com/en-us/security-updates/securityb…

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-0…

https://isc.sans.edu/forums/diary/16985

https://oval.cisecurity.org/repository/search/definition/ov…

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%…

http://www.darkreading.com/vulnerability/new-ie-vulnerabili…

http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild…

http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-d…

http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering…

http://www.us-cert.gov/ncas/alerts/TA13-317A

http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-…

http://blogs.technet.com/b/msrc/archive/2013/11/11/activex-control-issue-being-…

https://docs.microsoft.com/en-us/security-updates/securityb…

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-0…

https://isc.sans.edu/forums/diary/16985

https://oval.cisecurity.org/repository/search/definition/ov…

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%…

http://www.darkreading.com/vulnerability/new-ie-vulnerabili…

http://www.darkreading.com/vulnerability/new-ie-vulnerability-found-in-the-wild…

http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-d…

http://www.fireeye.com/blog/technical/2013/11/new-ie-zero-day-found-in-watering…

http://www.us-cert.gov/ncas/alerts/TA13-317A

CVE-2013-3918

Description

EPSS (Exploit Prediction Scoring System)

EPSS (Exploit Prediction Scoring System)

EPSS Score Trend (Last 90 Days)

Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Consequences

Applicable Platforms

Out-of-bounds Write

Common Consequences

Applicable Platforms

Microsoft Internet Explorer - CardSpaceClaimCollection ActiveX Integer Underflow …

Windows 8 by Microsoft

Product Information

Windows Server 2003 by Microsoft

Product Information

Windows Server 2008 by Microsoft

Product Information

Windows 7 by Microsoft

Product Information

Windows Server 2012 by Microsoft

Product Information

Windows Rt by Microsoft

Product Information

Windows Server 2008 by Microsoft

Product Information

Windows Server 2008 by Microsoft

Product Information

Windows Vista by Microsoft

Product Information

Windows Xp by Microsoft

Product Information

Windows Rt 8.1 by Microsoft

Product Information

Windows Xp by Microsoft

Product Information

Windows Server 2012 by Microsoft

Product Information

Windows 8.1 by Microsoft

Product Information

Iscriviti alla newsletter