PT-2009-3704 · Microsoft · Internet Explorer

Jorge Luis Alvarez Medina · Publicado 2009-06-10 · Atualizado 2023-12-07 · CVE-2009-1140

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4 through 7 for various Windows operating systems

Description The issue allows remote attackers to bypass the Same Origin Policy, potentially leading to information disclosure. This is due to the incorrect handling of cached content, which can be exploited by constructing a specially crafted Web page. If successfully exploited, an attacker could view content from the local computer or another browser window in another domain or Internet Explorer zone.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 through 7, consider restricting access to cached content to minimize the risk of exploitation. As a temporary workaround, avoid viewing specially crafted Web pages that could potentially bypass Internet Explorer domain restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-1140

Produtos afetados

Internet Explorer

Referências · 9

• 🔥 https://exploit-db.com/exploits/33024 · Exploit
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-019 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1140 · Nota de Segurança
• http://securitytracker.com/id?1022350 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6278 · Nota
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Nota
• http://vupen.com/english/advisories/2009/1538 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1140 · Nota de Segurança