PT-2009-2776 · Microsoft · Internet Explorer

Sam Thomas · Published 2009-02-10 · Updated 2023-12-07 · CVE-2009-0076

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 7

Description A remote code execution issue exists in the way Internet Explorer handles Cascading Style Sheets (CSS). This could be exploited by an attacker constructing a specially crafted Web page, potentially allowing remote code execution when a user views the page. The attacker could gain the same user rights as the logged on user. The issue is related to the use of the zoom style directive in conjunction with other directives in a malformed CSS stylesheet in a crafted HTML document.

Recommendations For Microsoft Internet Explorer version 7, consider restricting access to crafted Web pages that utilize malicious CSS stylesheets until a patch is available. As a temporary workaround, avoid using Internet Explorer to view untrusted Web pages.

Exploit

Fix

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-0076

Affected Products

Internet Explorer

References · 12

• 🔥 https://exploit-db.com/exploits/8152 · Exploit
• 🔥 https://exploit-db.com/exploits/8079 · Exploit
• 🔥 https://exploit-db.com/exploits/8082 · Exploit
• 🔥 https://exploit-db.com/exploits/8080 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0076 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0076 · Security Note
• http://us-cert.gov/cas/techalerts/TA09-041A.html · Note
• http://vupen.com/english/advisories/2009/0389 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6081 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-012 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-002 · Note