# MA-199.112009: MyCERT Alert - Multiple Critical Vulnerabilities in Microsoft Internet Explorer

**Date:** 04 Nov 2009  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-199.112009  
**Advisory ID:** MA-199.112009

---

**1.0 Introduction**
Multiple critical vulnerabilities have been identified in Microsoft Internet Explorer. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system while failed attack may cause denial-of-service conditions.
Essentially, an attacker can trick unsuspecting users into opening a URL that contain a specially crafted Web page using Internet Explorer.
**2.0 Impact**
An attacker who has successfully exploited this vulnerability could execute code remotely and gain the same privilege as the user. Failed attack may cause denial-of-service conditions.
**3.0 Affected Products**
The detail list of the vulnerable products and versions are as below:
- Microsoft Internet Explorer 5.01 SP 4
- Microsoft Internet Explorer 6
- Microsoft Internet Explorer 6 Service Pack 1
- Microsoft Internet Explorer 7
- Microsoft Internet Explorer 8
**4.0 Recommendation**
- Microsoft recommended user to enable the Automatic Updates feature because this security update will be downloaded and installed automatically. For information about specific configuration options in automatic updating, please refer this URL: [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)
- If user is not able to perform the update by using Automatic Updates feature, manual download for the patch can be obtained for specific browser version and operating system from the following URL:
<http://support.microsoft.com/kb/976749>
Generally MyCERT advice users of this product to keep themselves updated with the latest security announcements by the vendor. Users who receive suspicious attachments or URL can forward them to MyCERT for further analysis. MyCERT can be reached through the following channels:
**E-mail :** [[email protected]](/cdn-cgi/l/email-protection#d7baaeb4b2a5a397baaeb4b2a5a3f9b8a5b0f9baae)
**Phone :** +603 89926969 or 1-300-88-2999 (monitored during business hours)
**Fax :** +603 89453442
**Handphone :** +60 19 2665850 (24x7 call incident reporting)
**SMS :** +60 19 2813801 (24x7 SMS reporting)
**Business Hours :** Mon - Fri 08:30 -17:30 MYT
**Web :** [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.microsoft.com/technet/security/bulletin/MS09-054.mspx>
- <http://support.microsoft.com/kb/976749>
- [https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4](https://www.mycert.org.my/portal/articles-content?menu=b9f3fdda-c343-4cb4-99a7-a7506cfb13ba&id=62275f48-f209-4440-af1a-c5425c875fa4
)