PT-2009-5063 · Microsoft · Internet Explorer

Publicado 2009-08-05 · Atualizado 2009-08-06 · CVE-2009-2668

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 6.0.2900.2180 Microsoft Internet Explorer versions 7 through 7.0.6000.16473

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by using an XML document composed of a long series of start-tags with no corresponding end-tags.

Recommendations For Microsoft Internet Explorer versions 6 through 6.0.2900.2180, update to a version later than 6.0.2900.2180 to resolve the issue. For Microsoft Internet Explorer versions 7 through 7.0.6000.16473, update to a version later than 7.0.6000.16473 to resolve the issue. As a temporary workaround, consider restricting the processing of XML documents with unbalanced tags to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-2668

Produtos afetados

Internet Explorer

Referências · 3

• http://archives.neohapsis.com/archives/bugtraq/2009-07/0193.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2668 · Nota de Segurança
• http://websecurity.com.ua/3216 · Nota