PT-2009-3199 · Microsoft · Internet Explorer+3

Published 2009-04-15 · Updated 2023-12-07 · CVE-2009-0550

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows HTTP Services versions 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 WinINet in Microsoft Internet Explorer versions 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008

Description A remote code execution issue exists due to the way Windows HTTP Services and WinINet handle NTLM credentials when a user connects to a remote web server via the HTTP protocol. This allows an attacker to capture and replay the user's NTLM credentials and execute arbitrary code in the context of the logged-on user. If the user has administrative rights, the attacker could gain complete control of the system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Windows HTTP Services versions 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, consider disabling the NTLM credential handling feature until a patch is available. For WinINet in Microsoft Internet Explorer versions 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008, restrict access to the NTLM credential handling functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2009-0550

Affected Products

Internet Explorer

Wininet

Windows

Windows Http Services

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2009-0550 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-013 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0550 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-014 · Vendor Advisory
• http://blogs.technet.com/srd/archive/2009/04/14/ntlm-credential-reflection-updates-for-http-clients.aspx · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5320 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6233 · Note
• http://osvdb.org/53619 · Note
• http://secunia.com/advisories/34678 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-013 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-014 · Note
• http://vupen.com/english/advisories/2009/1027 · Note
• http://secunia.com/advisories/34677 · Note
• http://securitytracker.com/id?1022041 · Note
• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=871138 · Note