Vulnerabilities > CVE-2009-0076 - Resource Management Errors vulnerability in Microsoft Internet Explorer 7

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
microsoft
CWE-399
nessus
exploit available
NVD
Published: 2009-02-10
Updated: 2023-12-07

Summary

Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted HTML document, aka "CSS Memory Corruption Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
1
OS
Microsoft
13

Common Weakness Enumeration (CWE)

Exploit-Db

  • descriptionMS Internet Explorer 7 Memory Corruption PoC (MS09-002) (win2k3sp2). CVE-2009-0075,CVE-2009-0076. Remote exploit for windows platform
    fileexploits/windows/remote/8082.html
    idEDB-ID:8082
    last seen2016-02-01
    modified2009-02-20
    platformwindows
    port
    published2009-02-20
    reporterwebDEViL
    sourcehttps://www.exploit-db.com/download/8082/
    titleMicrosoft Internet Explorer 7 - Memory Corruption PoC MS09-002 win2k3sp2
    typeremote
  • descriptionMS Internet Explorer 7 Memory Corruption Exploit (MS09-002) (xp sp2). CVE-2009-0075,CVE-2009-0076. Remote exploit for windows platform
    fileexploits/windows/remote/8079.html
    idEDB-ID:8079
    last seen2016-02-01
    modified2009-02-20
    platformwindows
    port
    published2009-02-20
    reporterAbysssec
    sourcehttps://www.exploit-db.com/download/8079/
    titleMicrosoft Internet Explorer 7 - Memory Corruption Exploit MS09-002 XP SP2
    typeremote
  • descriptionMS Internet Explorer 7 Memory Corruption Exploit (MS09-002) (fast). CVE-2009-0075,CVE-2009-0076. Remote exploit for windows platform
    idEDB-ID:8152
    last seen2016-02-01
    modified2009-03-04
    published2009-03-04
    reporterAhmed Obied
    sourcehttps://www.exploit-db.com/download/8152/
    titleMicrosoft Internet Explorer 7 - Memory Corruption Exploit MS09-002
  • descriptionMS Internet Explorer 7 Memory Corruption Exploit (MS09-002) (py). CVE-2009-0075,CVE-2009-0076. Remote exploit for windows platform
    fileexploits/windows/remote/8080.py
    idEDB-ID:8080
    last seen2016-02-01
    modified2009-02-20
    platformwindows
    port
    published2009-02-20
    reporterDavid Kennedy (ReL1K)
    sourcehttps://www.exploit-db.com/download/8080/
    titleMicrosoft Internet Explorer 7 - Memory Corruption Exploit MS09-002 py
    typeremote

Msbulletin

bulletin_idMS09-002
bulletin_url
date2009-02-10T00:00:00
impactRemote Code Execution
knowledgebase_id961260
knowledgebase_url
severityCritical
titleCumulative Security Update for Internet Explorer (961260)

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS09-002.NASL
descriptionThe remote host is missing IE Security Update 961260. The remote version of IE is affected by two memory corruption vulnerabilities that may allow an attacker to execute arbitrary code on the remote host.
last seen2020-06-01
modified2020-06-02
plugin id35630
published2009-02-11
reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/35630
titleMS09-002: Cumulative Security Update for Internet Explorer (961260)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(35630);
  script_version("1.32");
  script_cvs_date("Date: 2018/11/15 20:50:30");

  script_cve_id("CVE-2009-0075", "CVE-2009-0076");
  script_bugtraq_id(33627, 33628);
  script_xref(name:"MSFT", value:"MS09-002");
  script_xref(name:"MSKB", value:"961260");
  script_xref(name:"EDB-ID", value:"8077");
  script_xref(name:"EDB-ID", value:"16555");

  script_name(english:"MS09-002: Cumulative Security Update for Internet Explorer (961260)");
  script_summary(english:"Determines the presence of update 961260");

  script_set_attribute(attribute:"synopsis", value:
"Arbitrary code can be executed on the remote host through the web
client.");
  script_set_attribute(attribute:"description", value:
"The remote host is missing IE Security Update 961260.

The remote version of IE is affected by two memory corruption
vulnerabilities that may allow an attacker to execute arbitrary code on
the remote host.");
  script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-002");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-09-011/");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-09-012/");
  script_set_attribute(attribute:"solution", value:
"Microsoft has released a set of patches for Windows XP, 2003, Vista and
2008.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');
  script_cwe_id(399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/02/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/02/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2009/02/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:ie");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows : Microsoft Bulletins");

  script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
  script_require_keys("SMB/MS_Bulletin_Checks/Possible");
  script_require_ports(139, 445, 'Host/patch_management_checks');

  exit(0);
}


include("audit.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_hotfixes.inc");
include("smb_func.inc");
include("misc_func.inc");

get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");

bulletin = 'MS09-002';
kb = "961260";

kbs = make_list(kb);
if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);


get_kb_item_or_exit("SMB/Registry/Enumerated");
get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);

if (hotfix_check_sp_range(xp:'2,3', win2003:'1,2', vista:'0,1') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);

rootfile = hotfix_get_systemroot();
if (!rootfile) exit(1, "Failed to get the system root.");

share = hotfix_path2share(path:rootfile);
if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);

if (
  # Vista / Windows 2008
  hotfix_is_vulnerable(os:"6.0", file:"Mshtml.dll", version:"8.0.6001.22352", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", file:"Mshtml.dll", version:"8.0.6001.18259", min_version:"8.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.22355", min_version:"7.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.18203", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:0, file:"Mshtml.dll", version:"7.0.6000.20996", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"6.0", sp:0, file:"Mshtml.dll", version:"7.0.6000.16809", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||

  # Windows 2003
  hotfix_is_vulnerable(os:"5.2", file:"Mshtml.dll", version:"8.0.6001.22352", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.2", file:"Mshtml.dll", version:"8.0.6001.18259", min_version:"8.0.6001.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.2", file:"Mshtml.dll", version:"7.0.6000.20996", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.2", file:"Mshtml.dll", version:"7.0.6000.16809", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||

  # Windows XP
  hotfix_is_vulnerable(os:"5.1", file:"Mshtml.dll", version:"8.0.6001.22352", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", file:"Mshtml.dll", version:"8.0.6001.18259", min_version:"8.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", file:"Mshtml.dll", version:"7.0.6000.20996", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
  hotfix_is_vulnerable(os:"5.1", file:"Mshtml.dll", version:"7.0.6000.16809", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb)
)
{
  set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
  hotfix_security_hole();
  hotfix_check_fversion_end();
  exit(0);
}
else
{
  hotfix_check_fversion_end();
  audit(AUDIT_HOST_NOT, 'affected');
}

Oval

accepted2014-08-18T04:06:08.978-04:00
classvulnerability
contributors
  • nameDragos Prisaca
    organizationGideon Technologies, Inc.
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Windows XP is installed
    ovaloval:org.mitre.oval:def:105
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows XP x64 is installed
    ovaloval:org.mitre.oval:def:15247
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
  • commentMicrosoft Windows XP x64 is installed
    ovaloval:org.mitre.oval:def:15247
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Internet Explorer 7 is installed
    ovaloval:org.mitre.oval:def:627
descriptionMicrosoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directive in conjunction with unspecified other directives in a malformed Cascading Style Sheets (CSS) stylesheet in a crafted HTML document, aka "CSS Memory Corruption Vulnerability."
familywindows
idoval:org.mitre.oval:def:6081
statusaccepted
submitted2009-02-10T16:00:00
titleCSS Memory Corruption Vulnerability
version72

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 33628 CVE(CAN) ID: CVE-2009-0076 Internet Explorer是微软Windows操作系统中默认捆绑的WEB浏览器。 Internet Explorer处理XHTML strict模式的CSS样式表时存在内存破坏漏洞。如果用户打开的CSS样式表包含有特定的样式指令组合，且其中一个为zoom，就可以触发这个漏洞，导致以当前登录用户的权限执行任意代码。 Microsoft Internet Explorer 7.0 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS09-002）以及相应补丁: MS09-002：Cumulative Security Update for Internet Explorer (961260) 链接：<a href=http://www.microsoft.com/technet/security/Bulletin/MS09-002.mspx?pf=true target=_blank rel=external nofollow>http://www.microsoft.com/technet/security/Bulletin/MS09-002.mspx?pf=true</a>
idSSV:4747
last seen2017-11-19
modified2009-02-13
published2009-02-13
reporterRoot
titleMicrosoft IE畸形CSS处理内存破坏漏洞（MS09-002）

References