PT-2009-4517 · Microsoft · Internet Explorer

Ming Zhang + 3 · Publicado 2009-06-15 · Atualizado 2018-10-30 · CVE-2009-2064

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8

Description The issue allows man-in-the-middle attackers to execute arbitrary web script in an https site's context. This is achieved by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

Recommendations For Microsoft Internet Explorer version 8, consider disabling the ability to load http content in https web pages as a temporary workaround until a patch is available. Restrict access to http sites that can be used to include malicious script files in iframes to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-2064

Produtos afetados

Internet Explorer

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/51186 · Nota
• http://research.microsoft.com/apps/pubs/default.aspx?id=79323 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2064 · Nota de Segurança
• http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf · Nota
• http://securityfocus.com/bid/35403 · Nota