Content
(MS09-019) Microsoft Internet Explorer HTML Objects Memory Corruption Vulnerability II (969897)
- Type
- Logic error
- Impact of exploitation
- Remote Code Execution
- User Interaction
- user interaction is needed
- Attack Vector
- Website with malicious content
- Rating
- Medium
- CVE reference
- CVE-2009-1531,
- Vendor Status
- Responded and patched
- Vulnerable systems
- Windows 2003 Itanium SP2,
- Internet Explorer 7,
- Internet Explorer 7 Windows Server 2003 SP2 Itanium,
- Internet Explorer 7 Windows 2000 SP4,
- Internet Explorer 7 Windows Vista SP1,
- Internet Explorer 7 Windows Vista X64 Edition SP1,
- Internet Explorer 7 Windows Server 2008 X64 Edition,
- Internet Explorer 7 Windows Server 2008 X32 Edition,
- Internet Explorer 7 Windows Server 2008 Itanium Edition,
- Internet Explorer 7 Windows XP SP2,
- Internet Explorer 7 Windows XP Professional X64 Edition SP2,
- Summary
- A vulnerability in Microsoft Internet Explorer may allow for remote code execution attacks.
Tab Navigation
Description
A vulnerability in Microsoft Internet Explorer may allow for remote code execution attacks. The flaw is specific to the method in which Internet Explorer access objects which have not been correctly initialized, or have been deleted. Under these conditions, system memory can become corrupted, allowing an attacker to execute arbitrary code. Exploitation can be achieved via a specially-crafted web page designed to target this issue.
McAfee Product Mitigation & Recommendations
Recommendations
The vendor has released a patch to address this issue: http://www.microsoft.com/technet/security/bulletin/ms09-019.mspx
McAfee Product Mitigation
McAfee Foundstone
- Signature:
- (MS09-019) Microsoft Internet Explorer HTML Objects Memory Corruption Vulnerability II (969897)
- Signature identifier:
- 6748
- Release date:
- 6/9/2009
McAfee Intrushield
- Signature:
- 4.1.51, 5.1.21
- Signature identifier:
- 0x40261500
- Release date:
- 6/9/2009
- First released in:
- HTTP: Microsoft IE HTML Objects Memory Corruption Vulnerability II
The Remedy V-Flash of 06/09/2009 will contain remedies for this issue. Windows Server 2008 is not supported.
- Release date:
- 6/10/2009
Additional Resources
Cumulative Security Update for Internet Explorer (969897)
http://www.microsoft.com/technet/security/bulletin/ms09-019.mspx
All Information
Timeline -
6/9/2009
Vendor has provided a patch.
Description -
A vulnerability in Microsoft Internet Explorer may allow for remote code execution attacks. The flaw is specific to the method in which Internet Explorer access objects which have not been correctly initialized, or have been deleted. Under these conditions, system memory can become corrupted, allowing an attacker to execute arbitrary code. Exploitation can be achieved via a specially-crafted web page designed to target this issue.
McAfee Product Mitigation & Recommendations
Recommendations -
The vendor has released a patch to address this issue: http://www.microsoft.com/technet/security/bulletin/ms09-019.mspx
McAfee Product Mitigation
McAfee Foundstone
- Signature:
- (MS09-019) Microsoft Internet Explorer HTML Objects Memory Corruption Vulnerability II (969897)
- Signature identifier:
- 6748
- Release date:
- 6/9/2009
McAfee Intrushield
- Signature:
- 4.1.51, 5.1.21
- Signature identifier:
- 0x40261500
- Release date:
- 6/9/2009
- First released in:
- HTTP: Microsoft IE HTML Objects Memory Corruption Vulnerability II
The Remedy V-Flash of 06/09/2009 will contain remedies for this issue. Windows Server 2008 is not supported.
- Release date:
- 6/10/2009
Additional Resources
Additional Resources -
Cumulative Security Update for Internet Explorer (969897)
http://www.microsoft.com/technet/security/bulletin/ms09-019.mspx
