Alert:Microsoft Security Bulletin - MS02-008From: Russ (Russ.Cooper@RC.ON.CA)
- Previous message: Russ: "Re: Microsoft Security Bulletin - MS02-011 and MS02-012 - again"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 28 Feb 2002 03:01:57 -0500 From: Russ <Russ.Cooper@RC.ON.CA> To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
XMLHTTP Control Can Allow Access to Local Files
Originally posted: February 21, 2002
Who should read this bulletin: Customers using Microsoft® XML Core Services 2.6 and later. This includes customers using Microsoft Windows® XP, SQL Server(tm) 2000, and Internet Explorer 6.0.
Impact of vulnerability: Information disclosure
Maximum Severity Rating: Critical
Recommendation: Customers and system administrators should apply the patch to all affected machines immediately.
- Microsoft XML Core Services versions 2.6, 3.0, and 4.0
- An affected version of Microsoft XML Core Services also ships as part of the following products:
- Microsoft Windows XP
- Microsoft Internet Explorer 6.0
- Microsoft SQL Server 2000
Microsoft XML Core Services (MSXML) includes the XMLHTTP ActiveX control, which allows web pages rendering in the browser to send or receive XML data via HTTP operations such as POST, GET, and PUT. The control provides security measures designed to restrict web pages so they can only use the control to request data from remote data sources.
A flaw exists in how the XMLHTTP control applies IE security zone settings to a redirected data stream returned in response to a request for data from a web site. A vulnerability results because an attacker could seek to exploit this flaw and specify a data source that is on the user's local system. The attacker could then use this to return information from the local system to the attacker's web site.
An attacker would have to entice the user to a site under his control to exploit this vulnerability. It cannot be exploited by HTML email. In addition, the attacker would have to know the full path and file name of any file he would attempt to read. Finally, this vulnerability does not give an attacker any ability to add, change or delete data.
- The vulnerability can only be exploited via a web site. It would not be possible to exploit this vulnerability via HTML mail.
- The attacker would need to know the full path and file name of a file in order to read it.
- The vulnerability does not provide any ability to add, change, or delete files.
Vulnerability identifier: CAN-2002-0057
This email is sent to NTBugtraq automatically as a service to my subscribers. Since its programmatically created, and since its been a long time since anyone paid actual money for my programming skills, it may or may not look that good...;-]
I can only hope that the information it does contain can be read well enough to serve its purpose.
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor
Delivery co-sponsored by Qualys - Make Your Network Secure
Go Beyond PARTIAL Security: FREE White Paper
Stop hassling with half-baked ENTERPRISE SECURITY.
FREE White Paper shows you how to ensure TOTAL security for your Internet
perimeter with the most current and most complete PROACTIVE Vulnerability
Assessment solution. Get your FREE White Paper now. Click here!