CVE-2013-3163 in microsoft internet explorer
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151.
Affected software: microsoft internet explorer
Scores
- CVSS: 8.8 (high)
- EPSS: 70.68% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2023-03-30
- Published: 2013-07-10
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Internet Explorer 8-10: install MS13-055 (KB2846071) or retire the browser
Patch or upgrade. CVE-2013-3163 is fixed by the July 2013 cumulative Internet Explorer update MS13-055 (KB2846071) and every later IE cumulative update. Internet Explorer 8-10 and the Windows versions they ran on are end-of-life, so CISA requires the product to be removed or disconnected if still in use.
Applies to: Internet Explorer 8, 9 and 10 (and 6/7 per the same bulletin) on Windows clients and servers without KB2846071 or a later cumulative IE update. Server Core installations are not affected.
- Inventory hosts that still run Internet Explorer 8, 9 or 10 (Windows XP, Vista, 7, 8, Server 2003/2008/2008 R2/2012); check the version under Help > About Internet Explorer or the version of C:\Windows\System32\mshtml.dll.
- Preferred: take these hosts out of service or upgrade them to a supported Windows release and use Microsoft Edge; on Windows 10/11 and Server 2016+ disable Internet Explorer 11 (Settings > Apps > Optional features, or via the Group Policy 'Disable Internet Explorer 11 as a standalone browser').
- If a legacy host cannot be retired yet: install security update KB2846071 (MS13-055) or a later cumulative Internet Explorer update via Windows Update, WSUS or the Microsoft Update Catalog, then reboot.
- For legacy hosts that must stay: block their outbound web access (proxy or firewall allow-list to the few internal sites they need) so they cannot open attacker-controlled web pages.
- Run a vulnerability scan again and confirm CVE-2013-3163 is no longer reported.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.