===================================================================== CERT-Renater Note d'Information No. 2009/VULN227 _____________________________________________________________________ DATE : 10/06/2009 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running Microsoft Internet Explorer. ====================================================================== KB969897 http://www.microsoft.com/technet/security/Bulletin/MS09-019.mspx ______________________________________________________________________ Microsoft Security Bulletin MS09-019 - Critical Cumulative Security Update for Internet Explorer (969897) Published: June 9, 2009 Version: 1.0 General Information Executive Summary This security update resolves seven privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This security update is rated Critical for Internet Explorer 5.01 and Important for Internet Explorer 6 Service Pack 1, running on supported editions of Microsoft Windows 2000; Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 running on supported editions of Windows XP and Windows Vista; and Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 running on supported editions of Windows Server 2003 and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section. The security update addresses these vulnerabilities by modifying the way that Internet Explorer handles scripts and cached content and initializes memory. Affected Software Internet Explorer 5.01 Service Pack 4 when installed on Microsoft Windows 2000 Service Pack 4 Internet Explorer 6 Service Pack 1 when installed on Microsoft Windows 2000 Service Pack 4 Internet Explorer 6 for Windows XP Service Pack 2 and Windows XP Service Pack 3 Internet Explorer 6 for Windows XP Professional x64 Edition Service Pack 2 Internet Explorer 6 for Windows Server 2003 Service Pack 2 Internet Explorer 6 for Windows Server 2003 x64 Edition Service Pack 2 Internet Explorer 6 for Windows Server 2003 with SP2 for Itanium-based Systems Internet Explorer 7 for Windows XP Service Pack 2 and Windows XP Service Pack 3 Internet Explorer 7 for Windows XP Professional x64 Edition Service Pack 2 Internet Explorer 7 for Windows Server 2003 Service Pack 2 Internet Explorer 7 for Windows Server 2003 x64 Edition Service Pack 2 Internet Explorer 7 for Windows Server 2003 with SP2 for Itanium-based Systems Internet Explorer 7 in Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 Internet Explorer 7 in Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 Internet Explorer 7 in Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected) Internet Explorer 7 in Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected) Internet Explorer 7 in Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2 Internet Explorer 8 for Windows XP Service Pack 2 and Windows XP Service Pack 3 Internet Explorer 8 for Windows XP Professional x64 Edition Service Pack 2 Internet Explorer 8 for Windows Server 2003 Service Pack 2 Internet Explorer 8 for Windows Server 2003 x64 Edition Service Pack 2 Internet Explorer 8 in Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 Internet Explorer 8 in Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 Internet Explorer 8 in Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected) Internet Explorer 8 in Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Server 2008 Server Core installation not affected) Vulnerability Information Race Condition Cross-Domain Information Disclosure Vulnerability - CVE-2007-3091 An information disclosure vulnerability exists in Internet Explorer that could allow script to gain access to the content in another browser window in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page. An attacker who successfully exploited this vulnerability could view data from a Web page in another Internet Explorer domain Cross-Domain Information Disclosure Vulnerability - CVE-2009-1140 An information disclosure vulnerability exists in the way that Internet Explorer caches data and incorrectly allows the cached content to be called, potentially bypassing Internet Explorer domain restriction. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page. An attacker who successfully exploited this vulnerability could view content from the local computer or another browser window in another domain or Internet Explorer zone. DHTML Object Memory Corruption Vulnerability - CVE-2009-1141 A remote code execution vulnerability exists in the way Internet Explorer displays a Web page that contains certain unexpected method calls to HTML objects. As a result, system memory may be corrupted in such a way that an attacker could execute arbitrary code if a user visited a specially crafted Web site. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. HTML Object Memory Corruption Vulnerability - CVE-2009-1528 A remote code execution vulnerability exists in the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Uninitialized Memory Corruption Vulnerability - CVE-2009-1529 A remote code execution vulnerability exists in the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. HTML Objects Memory Corruption Vulnerability - CVE-2009-1530 A remote code execution vulnerability exists in the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. HTML Object Memory Corruption Vulnerability - CVE-2009-1531 A remote code execution vulnerability exists in the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. HTML Object Memory Corruption Vulnerability - CVE-2009-1532 A remote code execution vulnerability exists in the way Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================