Nessus Plugin #10866

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

XML Core Services patch (Q318203)

Family:

Windows : Microsoft Bulletins

Category:

infos

Copyright:

This script is Copyright (C) 2002 Michael Scheidell

Summary:

Determines whether the XML Core Services patch Q318202/Q318203 is installed

Version:

$Revision: 1.17 $

Cve_id:

CVE-2002-0057

Bugtraq_id:

3699

Xrefs:

-

Description:

XMLHTTP Control Can Allow Access to Local Files.

A flaw exists in how the XMLHTTP control applies IE security zone
settings to a redirected data stream returned in response to a
request for data from a web site. A vulnerability results because
an attacker could seek to exploit this flaw and specify a data
source that is on the user's local system. The attacker could
then use this to return information from the local system to the
attacker's web site.

Impact of vulnerability: Attacker can read files on client system.

Affected Software:

Microsoft XML Core Services versions 2.6, 3.0, and 4.0.
An affected version of Microsoft XML Core Services also
ships as part of the following products:

Microsoft Windows XP
Microsoft Internet Explorer 6.0
Microsoft SQL Server 2000

(note: versions earlier than 2.6 are not affected
files affected include msxml[2-4].dll and are found
in the system32 directory. This might be false
positive if you have earlier version)

See http://www.microsoft.com/technet/security/bulletin/ms02-008.mspx

Risk factor : High