Check Point Advisories

Microsoft Internet Explorer Cloned Object Memory Corruption (MS09-002; CVE-2009-0075)

Vulnerability
Protection

Check Point Reference:	CPAI-2013-014
Date Published:	14 Jan 2013
Severity:	High
Last Updated:	Friday 19 April, 2024
Source:	CVE-2009-0075
Protection Provided by:	Security Gateway R75
Who is Vulnerable?	Microsoft Internet Explorer 7
Vulnerability Description	A vulnerability exists in the way Internet Explorer 7 accesses an object that has been deleted, which can cause memory corruption. In an attack case where code injection is successful, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security context of the current logged on user. In an attack case where code injection is not successful, Internet Explorer will terminate abnormally.
Update/Patch Avaliable	Apply patches from: MS09-002
Vulnerability Details	The vulnerability is due to the way Internet Explorer handles reference counting of objects and function pointers. A remote attacker can exploit this vulnerability by enticing the target user to view a malicious HTML file.

Protection Overview

The protection will block the transfer of malicious files attempting to exploit the vulnerability.

Security Gateway R75 / R71 / R70

In the IPS tab, click Protections and find the Microsoft Internet Explorer Cloned Object Memory Corruption (MS09-002) protection using the Search tool and Edit the protection's settings.
Install policy on all modules.

SmartView Tracker will log the following entries:
Attack Name: Web Client Enforcement Violation
Attack Information: Microsoft Internet Explorer Cloned Object Memory Corruption (MS09-002)