CVE-2009-0553

published 2009-04-15

CVE-2009-0553: Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on…

Priority P2 64 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

EXPLOIT

Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCs extracted from sources · hover to see the quote

url http://skypher.com/SkyLined/Repro/MSIE/EMBED%20memory%20corruption/repro3.html↗

• → Exploit triggers via a web page using an EMBED element with a large array of MIME types to cause memory corruption in Internet Explorer (MS09-014 / CVE-2009-0553). Detection should focus on EMBED elements cycling through an unusually large or exhaustive list of MIME types. ↗
• → The vulnerability is triggered by an object in memory that was not properly initialized or was deleted; monitor for IE process crashes or abnormal memory access patterns when processing EMBED tags with exotic MIME types. ↗

• · Affected versions are IE 6 SP1, IE 6 and 7 on Windows XP SP2/SP3, IE 6 and 7 on Windows Server 2003 SP1/SP2, IE 7 on Windows Vista Gold/SP1, and IE 7 on Windows Server 2008. Detection rules should be scoped to these specific platform/version combinations. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-399