Vulnerability: MS09-046 - Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (956844)
Back to Latest vulnerabilities homepage
Click any highlighted term for further explanation.
| Details | |
|---|---|
| Vulnerability name/brief description | MS09-046 - Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (956844) |
| CVE/CAN name | CVE-2009-2519 |
| Vendor threat level | Critical |
| SophosLabs threat level | Medium |
| Solution | |
| Vendor description | This security update resolves a privately reported vulnerability in the DHTML Editing Component ActiveX control. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
| SophosLabs comments | Although this vulnerability could allow remote code execution it is another privately reported issue, and as with other recent attacks of this kind requires a user to visit a malicious/compromised web site. Given these factors and that the vulnerability is patched in MS09-046 SophosLabs have assigned this vulnerability a threat level of medium. |
| SophosLabs testing result | N/A |
| Currently known exploits | At the time of writing SophosLabs has seen no samples of malware or web-content attempting to exploit this vulnerability. Should this situation change samples will be analyzed and we will take action as necessary. |
| First sample seen | N/A |
| Discovery date | 08 September 2009 |
| Affected software | Microsoft Windows 2000 Service Pack 4 Windows XP Service Pack 2 and Windows XP Service Pack 3 Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems |
| References | http://www.microsoft.com/technet/security/Bulletin/MS09-046.mspx http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2519 |
| Credits | Microsoft MAPP program |
| Revisions | 09 September 2009 - Initial analysis written |
Explanation of terms
Vulnerability Name/Brief Description:
Vendor identifier plus a brief description of the type of attack.
CVE/CAN Name:
Currently assigned CVE name. If a CVE name doesn't exist the CAN name will be used until a CVE has been assigned.
Vendor Threat Level:
Threat level assigned by the vendor
SophosLabs Threat Level:
Threat level assigned by SophosLabs
- LOW RISK - There is little chance of this vulnerability being actively exploited by malware.
- MEDIUM RISK - There is a possibility of this vulnerability being actively exploited by malware.
- HIGH RISK - There is a strong possibility of this vulnerability being actively exploited by malware.
- CRITICAL RISK - This vulnerability will almost certainly be actively exploited by malware.
Solution:
Vendor-supplied Patch identifier and recommended solution, or workaround if applicable.
Vendor Description:
Summary of the cause and potential effect of the vulnerability provided by the vendor.
SophosLabs Comments:
SophosLabs' opinions and observations of the vulnerability in question.
SophosLabs Testing Result:
Details of completed lab testing, if applicable. Please note that the lab test environment may differ significantly from user environments.
Currently Known Exploits:
List of identities for known exploits, if applicable.
First Sample Seen:
Date of the first sample seen by SophosLabs.
Discovery Date:
Date of the earliest known publically disclosed advisory.
Affected Software:
Vulnerable platforms and software versions.
If you need more information or guidance, then please contact technical support.
- Article ID: 62936
- Created: 9 Sep 2009
- Last updated: 9 Sep 2009
