header-logo
Suggest Exploit
vendor:
Internet Explorer
by:
Unknown
N/A
CVSS
N/A
Memory Corruption
Unknown
CWE
Product Name: Internet Explorer
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE: CVE-2009-1547
CPE: Unknown
Metasploit:
Other Scripts: https://www.infosecmatter.com/nessus-plugin-library/?id=42110, https://www.infosecmatter.com/nessus-plugin-library/?id=125000, https://www.infosecmatter.com/nessus-plugin-library/?id=63892, https://www.infosecmatter.com/nessus-plugin-library/?id=42996, https://www.infosecmatter.com/nessus-plugin-library/?id=39474, https://www.infosecmatter.com/nessus-plugin-library/?id=42826, https://www.infosecmatter.com/nessus-plugin-library/?id=41573, https://www.infosecmatter.com/nessus-plugin-library/?id=42429, https://www.infosecmatter.com/nessus-plugin-library/?id=35415, https://www.infosecmatter.com/nessus-plugin-library/?id=35419
Platforms Tested: Unknown
2009

MSIE Content-Encoding: deflate memory corruption vulnerability

Microsoft fixed a bug in Internet Explorer’s “Content-Encoding:deflate” implementation. The bug allows memory corruption, which can be exploited to execute arbitrary code. The big surprise (to me at least) is that nobody seems to have found this before even though it’s fairly easy to trigger.

Mitigation:

Unknown
Source

Exploit-DB raw data:

MSIE Content-Encoding: deflate memory corruption vulnerability

(a.k.a. MSRC 8769, MS09-054, CVE-2009-1547, “Data Stream Header Corruption Vulnerability”)

Microsoft fixed a bug in Internet Explorer’s “Content-Encoding:deflate” implementation. Here are two HTTP replies that trigger the bug:

HTTP/.\nContent-Encoding:deflate\r\t\n\r\n\x20\x20
HTTP \nContent-Encoding:deflate\nContent-Range:\n\n”

The bug allows memory corruption, which can be exploited to execute arbitrary code. The big surprise (to me at least) is that nobody seems to have found this before even though it’s fairly easy to trigger.

Navigation

Suggest Exploit

Services By CQR