CERT-In Vulnerability Note
CIVN-2009-0122
Microsoft Internet Explorer Remote Code Execution Vulnerabilities
Original Issue Date:October 15, 2009
Severity Rating: HIGH
Systems Affected
- Internet Explorer 5.01
- Internet Explorer 6
- Internet Explorer 6 SP 1
- Internet Explorer 7
- Internet Explorer 8
Overview
Multiple vulnerabilities were reported in Microsoft Internet Explorer, which could be exploited by remote attackers to cause arbitrary code to be executed on the target user's system.
Description
1. Data Stream Header Corruption Vulnerability
(
CVE-2009-1547
)
This vulnerability exists due to errors when Internet Explorer handles malformed data stream headers. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious website that contains malicious data streams. The processing of malicious data could trigger memory corruption that the attacker could leverage to execute arbitrary code with the privileges of the user.
2. HTML Component Handling Vulnerability
(
CVE-2009-2529
)
This vulnerability exists due to errors in handling variable arguments within HTML components processed by Internet Explorer. An unauthenticated, remote attacker could exploit this vulnerability by tricking an unsuspecting victim into viewing a web page containing malicious content. Successful exploitation will result in the execution of arbitrary code in the context of the currently logged in user.
3. Uninitialized Memory Corruption Vulnerabilities
(
CVE-2009-2530CVE-2009-2531
)
These vulnerabilities exist in the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An unauthenticated, remote attacker could exploit this vulnerability by convincing the user to view a malicious website. The processing of the website could trigger a memory corruption error that the attacker could use to execute arbitrary code with the privileges of the user. A n attacker who successfully exploited this vulnerability could take complete control of an affected system.
Workaround
- Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones
- Disable XAML browser applications in Internet Explorer
- Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones.
- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS09-054
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms09-054.mspx
References
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms09-054.mspx
Secunia
http://secunia.com/advisories/36979
VUPEN
http://www.vupen.com/english/advisories/2009/2889
SecurityTracker
http://securitytracker.com/alerts/2009/Oct/1023002.html
CVE Name
CVE-2009-1547
CVE-2009-2529
CVE-2009-2530
CVE-2009-2531
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|