PT-2009-4378 · Microsoft · Internet Explorer

Ling + 1 · Published 2009-07-29 · Updated 2023-12-07 · CVE-2009-1918

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 5.01 SP4 through 8

Description: A remote code execution issue exists due to improper handling of table operations, allowing attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption by adding malformed elements to an empty DIV element, related to the getElementsByTagName method. This could be exploited by constructing a specially crafted Web page. When a user views the Web page, the issue could allow remote code execution, potentially giving an attacker the same user rights as the logged-on user. If the user has administrative rights, the attacker could take complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations: For Microsoft Internet Explorer versions 5.01 SP4 through 8, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to Web pages that could potentially exploit this issue until a patch is available. Avoid using the getElementsByTagName method in affected HTML documents until the issue is resolved.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-1918

Affected Products

Internet Explorer

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2009-1918 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-034 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1918 · Security Note
• http://securitytracker.com/id?1022611 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-047 · Note
• http://us-cert.gov/cas/techalerts/TA09-195A.html · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-034 · Note
• http://securityfocus.com/bid/35826 · Note
• http://vupen.com/english/advisories/2009/2033 · Note
• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=953693 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5524 · Note
• http://securityfocus.com/archive/1/505523/100/0/threaded · Note