Vulnerability Name:

CVE-2009-1530 (CCN-50773)

Assigned:2009-06-09
Published:2009-06-09
Updated:2021-07-23
Summary:Use-after-free vulnerability in Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code by repeatedly adding HTML document nodes and calling event handlers, which triggers an access of an object that (1) was not properly initialized or (2) is deleted, aka "HTML Objects Memory Corruption Vulnerability."
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-399
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2009-1530

Source: OSVDB
Type: UNKNOWN
54949

Source: CCN
Type: SA35362
Microsoft Internet Explorer Multiple Vulnerabilities

Source: CCN
Type: SECTRACK ID: 1022350
Microsoft Internet Explorer Bugs Let Remote Users Execute Arbitrary Code

Source: CCN
Type: ASA-2009-221
MS09-019 Cumulative Security Update for Internet Explorer (969897)

Source: CCN
Type: NORTEL BULLETIN ID: 2009009559, Rev 1
Nortel Response to Microsoft Security Bulletin MS09-019

Source: CCN
Type: Microsoft Security Bulletin MS09-019
Cumulative Security Update for Internet Explorer (969897)

Source: CCN
Type: OSVDB ID: 54949
Microsoft IE Crafted HTML Document Node Addition Event Handler Memory Corruption

Source: BUGTRAQ
Type: UNKNOWN
20090610 ZDI-09-038: Microsoft Internet Explorer Event Handler Memory Corruption Vulnerability

Source: CCN
Type: BID-35224
Microsoft Internet Explorer Event Handler Uninitialized Memory Remote Code Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1022350

Source: CERT
Type: US Government Resource
TA09-160A

Source: VUPEN
Type: Vendor Advisory
ADV-2009-1538

Source: MISC
Type: UNKNOWN
http://www.zerodayinitiative.com/advisories/ZDI-09-038

Source: MS
Type: UNKNOWN
MS09-019

Source: XF
Type: UNKNOWN
ms-ie-htmlobjects-code-execution(50773)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6294

Source: CCN
Type: ZDI-09-038
Microsoft Internet Explorer Event Handler Memory Corruption Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:internet_explorer:6:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:*:pro_x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:pro_x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp1:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:gold:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*

    • Configuration 3:
  • cpe:/a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:sp1:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:sp2:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_xp:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*
  • AND
  • cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:*:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*
  • OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:6294
    V
    		HTML Objects Memory Corruption Vulnerability
    2014-08-18
    BACK
    microsoft internet explorer 6
    microsoft windows xp * sp2
    microsoft windows xp * sp3
    microsoft windows server 2003 * sp1
    microsoft windows xp *
    microsoft windows xp * sp2
    microsoft windows server 2003 * sp1
    microsoft windows server 2003 * sp2
    microsoft windows server 2003 *
    microsoft internet explorer 7
    microsoft windows vista * sp1
    microsoft windows server 2008 *
    microsoft windows server 2003 * sp1
    microsoft windows vista * sp1
    microsoft windows server 2008 *
    microsoft windows server 2003 * sp1
    microsoft windows xp *
    microsoft windows xp * sp2
    microsoft windows server 2003 * sp2
    microsoft windows vista gold
    microsoft windows server 2008 *
    microsoft windows xp * sp2
    microsoft windows vista *
    microsoft windows server 2003 *
    microsoft windows xp * sp3
    microsoft windows vista *
    microsoft windows server 2008 *
    microsoft internet explorer 6 sp1
    microsoft windows 2000 * sp4
    microsoft internet explorer 5.01
    microsoft windows 2000 * sp4
    microsoft internet explorer 5.01 sp4
    microsoft windows 2000 * sp4
    microsoft internet explorer 8
    microsoft windows vista * sp2
    microsoft windows vista *
    microsoft windows vista sp1
    microsoft windows vista sp2
    microsoft windows server 2008 - sp2
    microsoft windows server 2008 *
    microsoft windows xp -
    microsoft windows xp sp3
    microsoft windows server 2003 * sp2
    microsoft windows vista *
    microsoft windows vista * sp1
    microsoft windows server 2008 *
    microsoft windows server 2008 * sp2
    microsoft ie 7.0
    microsoft windows server 2008 -
    microsoft windows server 2008
    microsoft windows xp sp2
    microsoft windows vista *
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows server_2003 sp2
    microsoft windows vista -
    microsoft windows xp sp2
    microsoft windows vista - sp1
    microsoft windows vista - sp1
    microsoft windows server 2008 -
    microsoft windows server 2008 -
    microsoft windows xp sp3
    microsoft windows vista - sp2
    microsoft windows vista - sp2
    microsoft windows server 2008 sp2
    microsoft windows server 2008 sp2