Vulnerability CVE-2010-0491 - CERT Civis.Net

Vulnerability Name:

CVE-2010-0491 (CCN-57303)

Assigned:

2010-03-30

Published:

2010-03-30

Updated:

2021-07-23

Summary:

Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by changing unspecified properties of an HTML object that has an onreadystatechange event handler, aka "HTML Object Memory Corruption Vulnerability."

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2010-0491

Source: IDEFENSE
Type: UNKNOWN
20100330 Microsoft Internet Explorer 'onreadystatechange' Use After Free Vulnerability

Source: CCN
Type: SA38860
Internet Explorer Multiple Vulnerabilities

Source: CCN
Type: SECTRACK ID: 1023773
Microsoft Internet Explorer Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information

Source: SECTRACK
Type: UNKNOWN
1023773

Source: CCN
Type: Microsoft Security Bulletin MS11-099
Cumulative Security Update for Internet Explorer (2618444)

Source: CCN
Type: Microsoft Security Bulletin MS12-010
Cumulative Security Update for Internet Explorer (2647516)

Source: CCN
Type: Microsoft Security Bulletin MS12-023
Cumulative Security Update for Internet Explorer (2675157)

Source: CCN
Type: Microsoft Security Bulletin MS12-037
Cumulative Security Update for Internet Explorer (2699988)

Source: CCN
Type: Microsoft Security Bulletin MS12-044
Cumulative Security Update for Internet Explorer (2719177)

Source: CCN
Type: Microsoft Security Bulletin MS12-052
Cumulative Security Update for Internet Explorer (2722913)

Source: CCN
Type: Microsoft Security Bulletin MS10-018
Cumulative Security Update for Internet Explorer (980182)

Source: CCN
Type: Microsoft Security Bulletin MS10-035
Cumulative Security Update for Internet Explorer (982381)

Source: CCN
Type: Microsoft Security Bulletin MS10-053
Cumulative Security Update for Internet Explorer (2183461)

Source: CCN
Type: Microsoft Security Bulletin MS10-071
Cumulative Security Update for Internet Explorer (2360131)

Source: CCN
Type: Microsoft Security Bulletin MS10-090
Cumulative Security Update for Internet Explorer (2416400)

Source: CCN
Type: Microsoft Security Bulletin MS11-003
Cumulative Security Update for Internet Explorer (2482017)

Source: CCN
Type: Microsoft Security Bulletin MS11-018
Cumulative Security Update for Internet Explorer (2497640)

Source: CCN
Type: Microsoft Security Bulletin MS11-050
Cumulative Security Update for Internet Explorer (2530548)

Source: CCN
Type: Microsoft Security Bulletin MS11-057
Cumulative Security Update for Internet Explorer (2559049)

Source: CCN
Type: Microsoft Security Bulletin MS11-081
Cumulative Security Update for Internet Explorer (2586448)

Source: BID
Type: Patch
39027

Source: CCN
Type: BID-39027
Microsoft Internet Explorer 'onreadystatechange' Event Handler Remote Code Execution Vulnerability

Source: CERT
Type: US Government Resource
TA10-068A

Source: CERT
Type: US Government Resource
TA10-089A

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2010-0744

Source: MS
Type: UNKNOWN
MS10-018

Source: XF
Type: UNKNOWN
ms-html-obj-code-exec(57303)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:8421

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:internet_explorer:6:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Configuration 2:

cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*

OR cpe:/a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*

OR cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*

AND

cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*

OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:-:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:8421	V	HTML Object Memory Corruption Vulnerability (CVE-2010-0491)	2010-06-07