Vulnerabilities > CVE-2009-0552 - Unspecified vulnerability in Microsoft IE and Internet Explorer

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

microsoft

critical

nessus

NVD

Published: 2009-04-15

Updated: 2021-07-23

Summary

Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 on Windows XP SP2 and SP3, and 6 on Windows Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."

Vulnerable Configurations

Part	Description	Count
Application	Microsoft Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 6 Microsoft IE 6.0	3
OS	Microsoft Microsoft Windows 2000 * Microsoft Windows XP * Microsoft Windows Server 2003 *	9

Msbulletin

bulletin_id	MS09-014
bulletin_url
date	2009-04-14T00:00:00
impact	Remote Code Execution
knowledgebase_id	963027
knowledgebase_url
severity	Critical
title	Cumulative Security Update for Internet Explorer

Nessus

NASL family	Windows : Microsoft Bulletins
NASL id	SMB_NT_MS09-014.NASL
description	The remote host is missing IE Security Update 963027. The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host.
last seen	2020-06-01
modified	2020-06-02
plugin id	36152
published	2009-04-15
reporter	This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/36152
title	MS09-014: Cumulative Security Update for Internet Explorer (963027)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(36152); script_version("1.34"); script_cvs_date("Date: 2018/11/15 20:50:30"); script_cve_id( "CVE-2008-2540", "CVE-2009-0550", "CVE-2009-0551", "CVE-2009-0552", "CVE-2009-0553", "CVE-2009-0554" ); script_bugtraq_id(29445, 34423, 34424, 34426, 34438); script_xref(name:"MSFT", value:"MS09-014"); script_xref(name:"MSKB", value:"963027"); script_xref(name:"EDB-ID", value:"8479"); script_name(english:"MS09-014: Cumulative Security Update for Internet Explorer (963027)"); script_summary(english:"Checks version of Mshtml.dll"); script_set_attribute(attribute:"synopsis", value: "Arbitrary code can be executed on the remote host through a web browser."); script_set_attribute(attribute:"description", value: "The remote host is missing IE Security Update 963027. The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host."); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2009/ms09-014"); script_set_attribute(attribute:"solution", value: "Microsoft has released a set of patches for Windows 2000, XP, 2003, Vista and 2008."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_cwe_id(94, 264, 399); script_set_attribute(attribute:"vuln_publication_date", value:"2009/04/14"); script_set_attribute(attribute:"patch_publication_date", value:"2009/04/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/15"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:ie"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc."); script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, 'Host/patch_management_checks'); exit(0); } include("audit.inc"); include("smb_func.inc"); include("smb_hotfixes.inc"); include("smb_hotfixes_fcheck.inc"); include("misc_func.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS09-014'; kb = "963027"; kbs = make_list(kb); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE); get_kb_item_or_exit("SMB/Registry/Enumerated"); get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1); if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'1,2', vista:'0,2') <= 0) audit(AUDIT_OS_SP_NOT_VULN); if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE); rootfile = hotfix_get_systemroot(); if (!rootfile) exit(1, "Failed to get the system root."); share = hotfix_path2share(path:rootfile); if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share); if ( # Vista / Windows 2008 hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.20613", min_version:"7.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.22389", min_version:"7.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.18226", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:0, file:"Mshtml.dll", version:"7.0.6000.21023", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"6.0", sp:0, file:"Mshtml.dll", version:"7.0.6000.16830", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Windows 2003 hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.21015", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.16825", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"6.0.3790.4470", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.2", sp:1, file:"Mshtml.dll", version:"6.0.3790.3304", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Windows XP hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"7.0.6000.21015", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", sp:3, file:"Mshtml.dll", version:"7.0.6000.16825", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", arch:"x64", file:"Mshtml.dll", version:"6.0.3790.4470", min_version:"6.0.3790.0", dir:"\System32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", arch:"x64", file:"Mshtml.dll", version:"6.0.3790.3304", min_version:"6.0.0.0", dir:"\System32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"6.0.2900.5764", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", sp:2, file:"Mshtml.dll", version:"7.0.6000.16825", min_version:"7.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"6.0.2900.3527", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| # Windows 2000 hotfix_is_vulnerable(os:"5.0", file:"Msrating.dll", version:"6.0.2800.1958", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) \|\| hotfix_is_vulnerable(os:"5.0", file:"Mshtml.dll", version:"5.0.3874.1900", min_version:"5.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ) { set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE); hotfix_security_hole(); hotfix_check_fversion_end(); exit(0); } else { hotfix_check_fversion_end(); audit(AUDIT_HOST_NOT, 'affected'); }

Oval

accepted

2009-06-29T04:00:26.771-04:00

class

vulnerability

contributors

name Dragos Prisaca
organization Gideon Technologies, Inc.
name Brendan Miles
organization The MITRE Corporation

definition_extensions

comment Microsoft Windows 2000 SP4 or later is installed
oval oval:org.mitre.oval:def:229
comment Microsoft Internet Explorer 5.01 SP4 is installed
oval oval:org.mitre.oval:def:325
comment Microsoft Windows 2000 SP4 or later is installed
oval oval:org.mitre.oval:def:229
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP SP2 or later is installed
oval oval:org.mitre.oval:def:521
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP (x86) SP3 is installed
oval oval:org.mitre.oval:def:5631
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows Server 2003 SP1 (x86) is installed
oval oval:org.mitre.oval:def:565
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows Server 2003 SP2 (x86) is installed
oval oval:org.mitre.oval:def:1935
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP Professional x64 Edition SP1 is installed
oval oval:org.mitre.oval:def:720
comment Microsoft Windows Server 2003 SP1 (x64) is installed
oval oval:org.mitre.oval:def:4386
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows XP x64 Edition SP2 is installed
oval oval:org.mitre.oval:def:4193
comment Microsoft Windows Server 2003 SP2 (x64) is installed
oval oval:org.mitre.oval:def:2161
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows Server 2003 SP1 for Itanium is installed
oval oval:org.mitre.oval:def:1205
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563
comment Microsoft Windows Server 2003 (ia64) SP2 is installed
oval oval:org.mitre.oval:def:1442
comment Microsoft Internet Explorer 6 is installed
oval oval:org.mitre.oval:def:563

description

family

windows

oval:org.mitre.oval:def:5551

status

accepted

submitted

2009-04-14T16:00:00

title

Uninitialized Memory Corruption Vulnerability

version

Seebug

bulletinFamily	exploit
description	BUGTRAQ ID: 34426,34424,34423,34438 CVE(CAN) ID: CVE-2009-0554,CVE-2009-0553,CVE-2009-0552,CVE-2009-0551 Internet Explorer是微软Windows操作系统中默认捆绑的WEB浏览器。 Internet Explorer处理在网页间导航时的过渡方式及访问尚未正确初始化或已被删除对象的方式存在多个内存破坏漏洞。攻击者可以通过构建特制的网页来利用该漏洞，当用户查看网页时，这些漏洞可能允许远程执行代码。成功利用此漏洞的攻击者可以获得与登录用户相同的用户权限。 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.0.1 SP4 Microsoft --------- Microsoft已经为此发布了一个安全公告（MS09-014）以及相应补丁: MS09-014：Cumulative Security Update for Internet Explorer (963027) 链接：<a href=http://www.microsoft.com/technet/security/bulletin/MS09-014.mspx?pf=true target=_blank rel=external nofollow>http://www.microsoft.com/technet/security/bulletin/MS09-014.mspx?pf=true</a>
id	SSV:5055
last seen	2017-11-19
modified	2009-04-16
published	2009-04-16
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-5055
title	Microsoft IE多个内存破坏漏洞（MS09-014）

Summary

Vulnerable Configurations

Msbulletin

Nessus

Oval

Seebug

References