CVE DatabaseCVE-2017-0059

Updated 2026-06-17한국어 권고문 →

CVE-2017-00594.3/MEDIUMCISA KEV

Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2017-0059) Technical Analysis and Hardening Guide

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

internet explorer

Published Date

2017-03-17

CVSS v3.1

4.3

MEDIUM

EPSS (30d)

62.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Microsoft Internet Explorer versions 9, 10, and 11 running on Windows operating systems.

Impact

Remote attackers can bypass ASLR and extract sensitive process memory data by enticing users to visit a specially crafted malicious website.

Mitigation

Apply the latest cumulative Windows security updates, disable Internet Explorer, and transition to modern secure browsers.

Affected Products & Version Scope

Microsoft Internet Explorer versions 9, 10, and 11 on all supported Windows platforms

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Since Internet Explorer has reached End-of-Life (EOL), organizations must ensure that the latest cumulative Windows updates are applied to secure legacy components. Use the following PowerShell commands to force Windows Update and apply all pending security patches:

powershell

# Install PSWindowsUpdate module and apply all security patches
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

2. Temporary Workaround & Hardening Configuration

To mitigate the risk entirely, disable Internet Explorer 11 across all endpoints. This prevents users from inadvertently launching the vulnerable browser. Run the following command to disable the IE feature:

powershell

# Disable Internet Explorer 11 feature on Windows (requires reboot)
Disable-WindowsOptionalFeature -Online -FeatureName 'Internet-Explorer-Optional-amd64' -NoRestart

3. Log Audit & IoC Verification Commands

Use this PowerShell script to audit the system and verify if a vulnerable version of Internet Explorer is currently installed and active:

powershell

# Audit Internet Explorer version from registry
$ieRegPath = 'HKLM:\SOFTWARE\Microsoft\Internet Explorer'
if (Test-Path $ieRegPath) {
    $ieVer = (Get-ItemProperty -Path $ieRegPath).svcVersion
    Write-Output 'Current IE Version: ' + $ieVer
    if ($ieVer -like '9.*' -or $ieVer -like '10.*' -or $ieVer -like '11.*') {
        Write-Error 'VULNERABLE: Internet Explorer 9-11 detected. Immediate action required to disable or patch.'
    } else {
        Write-Output 'IE is not in the highly vulnerable range.'
    }
}

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Immediately disable Internet Explorer across all enterprise endpoints and transition to modern browsers with active security support.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

CVE-2017-0059 is an information disclosure vulnerability in Microsoft Internet Explorer 9, 10, and 11. The root cause lies in the browser's memory management engine, which fails to properly validate object boundaries and size constraints when rendering specific HTML elements or executing JavaScript. This lack of validation leads to an Out-of-bounds Read (CWE-125), allowing unauthorized access to uninitialized memory or adjacent memory blocks belonging to the browser process.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by hosting a malicious web page containing crafted HTML, CSS, and JavaScript. When a victim visits the site (via drive-by compromise or phishing links), the browser's rendering engine processes the malformed objects, corrupting the memory layout. Using techniques like Heap Feng Shui, the attacker's JavaScript reads data beyond the allocated buffer boundaries. The leaked memory addresses are then exfiltrated to the attacker's server, providing the critical layout information needed to bypass Address Space Layout Randomization (ASLR) and facilitate subsequent Remote Code Execution (RCE) attacks.

3. Infrastructure & Business Impact

As a vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2017-0059 has been actively exploited in targeted campaigns. In an enterprise environment, the exposure of process memory can lead to the theft of sensitive session tokens, API keys, and user credentials stored in memory. This compromise serves as a primary entry point for threat actors to establish a foothold, escalate privileges, and deploy ransomware across the internal network.

Official Vendor Advisories & References

NVD Original English Description

Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009.

http://www.securityfocus.com/bid/96645

Source: secure@microsoft.com · Broken Link, Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1038008

Source: secure@microsoft.com · Broken Link, Third Party Advisory, VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0059

Source: secure@microsoft.com · Patch, Vendor Advisory

https://www.exploit-db.com/exploits/41661/

Source: secure@microsoft.com · Exploit, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/42354/

Source: secure@microsoft.com · Exploit, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/43125/

Source: secure@microsoft.com · Exploit, Third Party Advisory, VDB Entry

Frequently Asked SecOps Questions (CVE-2017-0059)

FAQ

Q1. How critical is CVE-2017-0059 and is it actively exploited in the wild?

CVE-2017-0059 is rated CVSS 4.3 (MEDIUM) with a 30-day EPSS exploitation probability of 62.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2017-0059?

Primary impacted vendors include microsoft across internet explorer. Scope summary: Microsoft Internet Explorer versions 9, 10, and 11 on all supported Windows platforms

Q3. What temporary mitigations or workarounds exist for CVE-2017-0059 before patching?

[Mitigation] Apply the latest cumulative Windows security updates, disable Internet Explorer, and transition to modern secure browsers. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION