MS09-046: Vulnerability in DHTML Editing Component ActiveX Control Could Allow Remote Code Execution (956844)

high Nessus Plugin ID 40889


Arbitrary code can be executed on the remote host through an ActiveX control.


The remote host is missing Security Update 956844. The DHTML Editing Component ActiveX Control on the remote host has a remote code execution vulnerability. A remote attacker could exploit this by tricking a user into viewing a specially crafted web page, resulting in the execution of arbitrary code.


Microsoft has released a set of patches for Windows 2000, XP, and 2003.

See Also

Plugin Details

Severity: High

ID: 40889

File Name: smb_nt_ms09-046.nasl

Version: 1.22

Type: local

Agent: windows

Published: 9/8/2009

Updated: 8/5/2020

Supported Sensors: Nessus

Risk Information


Risk Factor: Medium

Score: 5.9


Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2009-2519

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Ease: No known exploits are available

Patch Publication Date: 9/8/2009

Vulnerability Publication Date: 9/8/2009

Reference Information

CVE: CVE-2009-2519

BID: 36280

CWE: 94

IAVA: 2009-A-0075-S

MSFT: MS09-046

MSKB: 956844