MS09-046: Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (956844)

high Nessus Plugin ID 40889

Synopsis

Arbitrary code can be executed on the remote host through an ActiveX control.

Description

The remote host is missing Security Update 956844. The DHTML Editing Component ActiveX Control on the remote host has a remote code execution vulnerability. A remote attacker could exploit this by tricking a user into viewing a specially crafted web page, resulting in the execution of arbitrary code.

Solution

Microsoft has released a set of patches for Windows 2000, XP, and 2003.

See Also

https://www.nessus.org/u?15c573d6

Plugin Details

Severity: High

ID: 40889

File Name: smb_nt_ms09-046.nasl

Version: 1.22

Type: local

Agent: windows

Published: 9/8/2009

Updated: 8/5/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2009-2519

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Ease: No known exploits are available

Patch Publication Date: 9/8/2009

Vulnerability Publication Date: 9/8/2009

Reference Information

CVE: CVE-2009-2519

BID: 36280

CWE: 94

IAVA: 2009-A-0075-S

MSFT: MS09-046

MSKB: 956844