PT-2009-4028 · Microsoft · Internet Explorer 7+1

Wushi · Published 2009-06-10 · Updated 2023-12-07 · CVE-2009-1531

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer 7 for Windows XP SP2 and SP3 Microsoft Internet Explorer 7 for Server 2003 SP2 Microsoft Internet Explorer 7 for Vista Gold, SP1, and SP2 Microsoft Internet Explorer 7 for Server 2008 SP2

Description: A remote code execution issue exists due to the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. This could be exploited by an attacker constructing a specially crafted Web page. When a user views the Web page, it could allow remote code execution, potentially giving the attacker the same user rights as the logged-on user. If the user has administrative rights, the attacker could take complete control of the system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations: For Microsoft Internet Explorer 7 on all affected platforms, consider restricting access to web pages that could potentially exploit this issue until a patch is available. As a temporary workaround, avoid using the getElementsByTagName function in combination with the creation of objects during reordering of elements, followed by an onreadystatechange event, until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-1531

Affected Products

Internet Explorer

Internet Explorer 7

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1531 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1531 · Security Note
• http://vupen.com/english/advisories/2009/1538 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-09-039 · Note
• http://securityfocus.com/bid/35234 · Note
• http://securitytracker.com/id?1022350 · Note
• http://us-cert.gov/cas/techalerts/TA09-160A.html · Note
• http://osvdb.org/54950 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/MS09-019 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6308 · Note
• http://securityfocus.com/archive/1/504216/100/0/threaded · Note