PT-2010-2049 · Microsoft · Internet Explorer

CVE-2010-0249 · Publicado 2010-01-14 · Atualizado 2026-05-21

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 8

Description The issue allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory. This has been exploited in the wild during Operation Aurora. An attacker could exploit the vulnerability by constructing a specially crafted Web page, potentially gaining the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker could take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Microsoft Internet Explorer versions 6 through 8, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to Web pages from untrusted sources until a patch is available. Avoid viewing specially crafted Web pages that could exploit the vulnerability.

Exploit

Correção

DoS

RCE

Use After Free

Enumeração de Fraquezas

CWE-399

CWE-416

Identificadores relacionados

BDU:2026-07706

CVE-2010-0249

Produtos afetados

Internet Explorer

Referências · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_002_aurora.rb · Exploit
• 🔥 http://securityfocus.com/bid/37815 · Exploit
• 🔥 https://exploit-db.com/exploits/11167 · Exploit
• 🔥 http://exploit-db.com/exploits/11167 · Exploit
• 🔥 https://exploit-db.com/exploits/16599 · Exploit
• https://t.me/cveNotify/164272 · Publicação no Telegram
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-07706 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-002 · Nota
• http://vupen.com/english/advisories/2010/0135 · Nota
• http://securitytracker.com/id?1023462 · Nota
• http://osvdb.org/61697 · Nota
• http://news.cnet.com/8301-27080_3-10435232-245.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55642 · Nota