PT-2009-4517 · Microsoft · Internet Explorer

Ming Zhang + 3 · Published 2009-06-15 · Updated 2018-10-30 · CVE-2009-2064

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8

Description The issue allows man-in-the-middle attackers to execute arbitrary web script in an https site's context. This is achieved by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

Recommendations For Microsoft Internet Explorer version 8, consider disabling the ability to load http content in https web pages as a temporary workaround until a patch is available. Restrict access to http sites that can be used to include malicious script files in iframes to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-2064

Affected Products

Internet Explorer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-2064 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51186 · Note
• http://research.microsoft.com/apps/pubs/default.aspx?id=79323 · Note
• http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf · Note
• http://securityfocus.com/bid/35403 · Note