PT-2009-3201 · Microsoft · Internet Explorer+2

Publicado 2009-04-15 · Atualizado 2021-07-23 · CVE-2009-0552

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4, 6 SP1 Microsoft Internet Explorer version 6 on Windows XP SP2 and SP3 Microsoft Internet Explorer version 6 on Windows Server 2003 SP1 and SP2

Description The issue allows remote attackers to execute arbitrary code via a web page that triggers the presence of an object in memory that was not properly initialized or deleted. A remote code execution vulnerability exists in the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted web page, potentially gaining the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 and 6 SP1, update to a newer version to mitigate the risk. For Microsoft Internet Explorer version 6 on Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Microsoft Internet Explorer version 6 on Windows Server 2003 SP1 and SP2, update to a newer version to mitigate the risk.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0552

Produtos afetados

Internet Explorer

Windows Server 2003

Windows Xp

Referências · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0552 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2009-0552 · Nota de Segurança
• http://secunia.com/advisories/34678 · Nota
• http://securitytracker.com/id?1022042 · Nota
• http://vupen.com/english/advisories/2009/1028 · Nota
• http://osvdb.org/53625 · Nota
• http://us-cert.gov/cas/techalerts/TA09-104A.html · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-014 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5551 · Nota
• http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm · Nota