PT-2009-5359 · Microsoft · Windows Xp+3

Irfan Asrar · Published 2009-08-31 · Updated 2017-09-19 · CVE-2009-3019

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer 6 versions on Windows XP SP2 and SP3 Microsoft Internet Explorer 7 version on Vista

Description: The issue allows remote attackers to cause a denial of service, resulting in an application crash, by utilizing JavaScript code. This code creates an instance of the LI element using createElement and then sets the value attribute using setAttribute.

Recommendations: For Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, consider disabling JavaScript execution until a patch is available. For Microsoft Internet Explorer 7 on Vista, restrict the use of the createElement function to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-3019

Affected Products

Internet Explorer 6

Internet Explorer 7

Vista

Windows Xp

References · 3

• 🔥 https://exploit-db.com/exploits/9455 · Exploit
• 🔥 http://exploit-db.com/exploits/9455 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3019 · Security Note