=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN039
_____________________________________________________________________

DATE                      : 11/02/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Internet Explorer.

======================================================================
KB961260
http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx
______________________________________________________________________

Microsoft Security Bulletin MS09-002 - Critical

Cumulative Security Update for Internet Explorer (961260)

   Published: February 10, 2009

   Version: 1.0

General Information

Executive Summary

   This security update resolves two privately reported vulnerabilities. The
   vulnerabilities could allow remote code execution if a user views a
   specially crafted Web page using Internet Explorer. Users whose accounts
   are configured to have fewer user rights on the system could be less
   impacted than users who operate with administrative user rights.

   This security update is rated Critical for Internet Explorer 7 running on
   supported editions of Windows XP and Windows Vista. For Internet
   Explorer 7 running on supported editions of Windows Server 2003 and
   Windows Server 2008, this security update is rated Moderate. For more
   information, see the subsection, Affected and Non-Affected Software, in
   this section.

   The security update addresses these vulnerabilities by modifying the way
   that Internet Explorer handles the error resulting in the exploitable
   condition. For more information about the vulnerabilities, see the
   Frequently Asked Questions (FAQ) subsection under the next section,
   Vulnerability Information.

   Recommendation. The majority of customers have automatic updating enabled
   and will not need to take any action because this security update will be
   downloaded and installed automatically. Customers who have not enabled
   automatic updating need to check for updates and install this update
   manually. For information about specific configuration options in
   automatic updating, see Microsoft Knowledge Base Article 294781.

   For administrators and enterprise installations, or end users who want to
   install this security update manually, Microsoft recommends that customers
   apply the update immediately using update management software, or by
   checking for updates using the Microsoft Update service.

Affected Software

   Internet Explorer 7

Vulnerability Information

Uninitialized Memory Corruption Vulnerability - CVE-2009-0075

A remote code execution vulnerability exists in the way Internet Explorer
accesses an object that has been deleted. An attacker could exploit the
vulnerability by constructing a specially crafted Web page. When a user
views the Web page, the vulnerability could allow remote code execution. An
attacker who successfully exploited this vulnerability could gain the same
user rights as the logged-on user.

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================