CVE-2009-4419

Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets in the SINIT Authenticated Code Module (ACM), which allows local users to bypass the Trusted Execution Technology protection mechanism and gain privileges by modifying the MCHBAR register to point to an attacker-controlled region, which prevents the SENTER instruction from properly applying VT-d protection while an MLE is being loaded.

• CWE-16

• http://invisiblethingslab.com/resources/misc09/Another%20TXT%20Attack.pdf
• http://osvdb.org/61248
• http://secunia.com/advisories/37900Vendor Advisory
• http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00021&languageid=en-frVendor Advisory
• http://theinvisiblethings.blogspot.com/2009/12/another-txt-attack.html
• http://www.securityfocus.com/bid/37430
• http://www.securitytracker.com/id?1023382
• http://www.vupen.com/english/advisories/2009/3618Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54963
• http://invisiblethingslab.com/resources/misc09/Another%20TXT%20Attack.pdf
• http://osvdb.org/61248
• http://secunia.com/advisories/37900Vendor Advisory
• http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00021&languageid=en-frVendor Advisory
• http://theinvisiblethings.blogspot.com/2009/12/another-txt-attack.html
• http://www.securityfocus.com/bid/37430
• http://www.securitytracker.com/id?1023382
• http://www.vupen.com/english/advisories/2009/3618Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54963

Published

Dec 24, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4413The httpClientDiscardBody function in client.c in Polipo 0.9…
• CVE-2009-4414SQL injection vulnerability in phpgwapi /inc/class.auth_sql.…
• CVE-2009-4415Multiple directory traversal vulnerabilities in phpGroupWare…
• CVE-2009-4416Cross-site scripting (XSS) vulnerability in login.php in php…
• CVE-2009-4417The shutdown function in the Zend_Log_Writer_Mail class in Z…
• CVE-2009-4418The unserialize function in PHP 5.3.0 and earlier allows con…
• CVE-2009-4420Buffer overflow in the bd daemon in F5 Networks BIG-IP Appli…
• CVE-2009-4421Directory traversal vulnerability in languages_cgi.php in Si…
• CVE-2009-4422Multiple cross-site scripting (XSS) vulnerabilities in the G…
• CVE-2009-4423SQL injection vulnerability in index.php in weenCompany 4.0.…
• CVE-2009-4424SQL injection vulnerability in results.php in the Pyrmont pl…
• CVE-2009-4425Cross-site scripting (XSS) vulnerability in index.php in iDe…