PT-2009-5063 · Microsoft · Internet Explorer

Published 2009-08-05 · Updated 2009-08-06 · CVE-2009-2668

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 6.0.2900.2180 Microsoft Internet Explorer versions 7 through 7.0.6000.16473

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by using an XML document composed of a long series of start-tags with no corresponding end-tags.

Recommendations For Microsoft Internet Explorer versions 6 through 6.0.2900.2180, update to a version later than 6.0.2900.2180 to resolve the issue. For Microsoft Internet Explorer versions 7 through 7.0.6000.16473, update to a version later than 7.0.6000.16473 to resolve the issue. As a temporary workaround, consider restricting the processing of XML documents with unbalanced tags to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2009-2668

Affected Products

Internet Explorer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2009-2668 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2009-07/0193.html · Note
• http://websecurity.com.ua/3216 · Note