PT-2009-6252 · Microsoft · Internet Explorer

Inferno · Published 2009-11-24 · Updated 2021-07-23 · CVE-2009-4073

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8

Description The issue allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page. This is related to the printing functionality.

Recommendations For Microsoft Internet Explorer version 8, consider disabling the printing functionality for PDF documents generated from local web pages until a patch is available. Restrict access to sensitive local pathnames and usernames to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-4073

Affected Products

Internet Explorer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2009-4073 · Security Note
• http://secunia.com/advisories/37362 · Note
• http://securethoughts.com/2009/11/millions-of-pdf-invisibly-embedded-with-your-internal-disk-paths · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12355 · Note
• http://securityfocus.com/archive/1/508010/100/0/threaded · Note
• http://theregister.co.uk/2009/11/23/internet_explorer_file_disclosure_bug · Note
• http://osvdb.org/60504 · Note