PT-2009-4026 · Microsoft · Internet Explorer 7+1

Peter Vreugdenhil · Published 2009-06-10 · Updated 2024-10-21 · CVE-2009-1529

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer 7 for Windows XP SP2 and SP3 Microsoft Internet Explorer 7 for Server 2003 SP2 Microsoft Internet Explorer 7 for Vista Gold, SP1, and SP2 Microsoft Internet Explorer 7 for Server 2008 SP2

Description: The issue arises from the improper handling of objects in memory, allowing remote attackers to execute arbitrary code. This can be achieved by calling the setCapture method on a collection of crafted objects. An attacker could exploit this by constructing a specially crafted Web page. When a user views the Web page, the issue could allow remote code execution, potentially granting the attacker the same user rights as the logged-on user. If the user has administrative rights, the attacker could take complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations: For Microsoft Internet Explorer 7 for Windows XP SP2 and SP3, update to a newer version to mitigate the risk. For Microsoft Internet Explorer 7 for Server 2003 SP2, update to a newer version to mitigate the risk. For Microsoft Internet Explorer 7 for Vista Gold, SP1, and SP2, update to a newer version to mitigate the risk. For Microsoft Internet Explorer 7 for Server 2008 SP2, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the setCapture method until a patch is available.

Fix

RCE

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

CWE-399

Related Identifiers

CVE-2009-1529

Affected Products

Internet Explorer

Internet Explorer 7

References · 13

• http://vupen.com/english/advisories/2009/1538 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1529 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1529 · Security Note
• http://securitytracker.com/id?1022350 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6295 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-036 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-019 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note
• http://securityfocus.com/archive/1/504205/100/0/threaded · Note
• https://t.me/cvenotify/99001 · Telegram Post
• http://securityfocus.com/bid/35223 · Note
• http://osvdb.org/54948 · Note