|
|
>> Microsoft XML Core Services Multiple Remote Vulnerabilities (MS08-069)
|
Multiple vulnerabilities have been identified in Microsoft XML Core Services (MSXML), which could be exploited by remote attackers to disclose sensitive information or take complete control of an affected system.
The first issue is caused by a memory corruption error when parsing malformed XML content, which could be exploited by attackers to execute arbitrary code by tricking a user into visiting a malicious web page.
The second vulnerability exists in the way MSXML handles error checks for external document type definitions (DTDs), which could be exploited by malicious web sites to conduct cross-domain scripting attacks and read data from another domain in IE.
The third issue is caused by an error in the way MSXML handles transfer-encoding headers, which could be exploited by malicious web sites to conduct cross-domain scripting attacks and read data from another domain in IE.
Affected Products
Microsoft XML Core Services 3.0
Microsoft XML Core Services 4.0
Microsoft XML Core Services 5.0
Microsoft XML Core Services 6.0
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Service Pack 3
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional x64 Edition Service Pack 2
Microsoft Windows Server 2003 Service Pack 1
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Server 2003 x64 Edition
Microsoft Windows Server 2003 x64 Edition Service Pack 2
Microsoft Windows Server 2003 SP1 (Itanium)
Microsoft Windows Server 2003 SP2 (Itanium)
Microsoft Windows Vista
Microsoft Windows Vista Service Pack 1
Microsoft Windows Vista x64 Edition
Microsoft Windows Vista x64 Edition Service Pack 1
Microsoft Windows Server 2008 (32-bit)
Microsoft Windows Server 2008 (x64)
Microsoft Windows Server 2008 (Itanium)
Microsoft Office 2003 Service Pack 3
Microsoft Word Viewer 2003 Service Pack 3
2007 Microsoft Office System
2007 Microsoft Office System Service Pack 1
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1
Microsoft Expression Web
Microsoft Expression Web 2
Microsoft Office SharePoint Server 2007 (32-bit editions)
Microsoft Office SharePoint Server 2007 Service Pack 1 (32-bit editions)
Microsoft Office SharePoint Server 2007 (64-bit editions)
Microsoft Office SharePoint Server 2007 Service Pack 1 (64-bit editions)
Microsoft Office Groove Server 2007
Solution
Apply patches :
http://www.microsoft.com/technet/security/Bulletin/ms08-069.mspx
References
http://www.vupen.com/english/advisories/2008/3111
http://www.microsoft.com/technet/security/Bulletin/ms08-069.mspx
Credits
Vulnerabilities reported by Michal Zalewski, Gregory Fleischer, Stefano Di Paola (Minded Security), and Robert Hansen (SecTheory).
ChangeLog
2008-11-11 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
