PT-2009-3704 · Microsoft · Internet Explorer

Jorge Luis Alvarez Medina · Published 2009-06-10 · Updated 2023-12-07 · CVE-2009-1140

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 5.01 SP4 through 7 for various Windows operating systems

Description The issue allows remote attackers to bypass the Same Origin Policy, potentially leading to information disclosure. This is due to the incorrect handling of cached content, which can be exploited by constructing a specially crafted Web page. If successfully exploited, an attacker could view content from the local computer or another browser window in another domain or Internet Explorer zone.

Recommendations For Microsoft Internet Explorer versions 5.01 SP4 through 7, consider restricting access to cached content to minimize the risk of exploitation. As a temporary workaround, avoid viewing specially crafted Web pages that could potentially bypass Internet Explorer domain restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-1140

Affected Products

Internet Explorer

References · 9

• 🔥 https://exploit-db.com/exploits/33024 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1140 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1140 · Security Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-019 · Note
• http://securitytracker.com/id?1022350 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6278 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note
• http://vupen.com/english/advisories/2009/1538 · Note