|
Advisories!: Microsoft Release Multiple Patches :: 22 January, 2003 |
|
|
 Title: Unchecked Buffer in Locator Service Could
Lead to Code Execution (810833)
Date: 22 January, 2003
Software: Microsoft Windows NT 4.0,
Windows 2000, and Windows XP
Impact: Run code of the attacker's choice
Max Risk: Critical
Bulletin: MS03-001
----------------------------------------------------------------------
Title: Cumulative Patch for Microsoft Content
Management Server (810487)
Date: 22 January 2003
Software: Microsoft Content
Management Server 2001
Impact: Information Disclosure
Max Risk:
Moderate
Bulletin: MS03-002
----------------------------------------------------------------------
Title: Flaw in how Outlook 2002 handles V1 Exchange
Server Security Certificates could lead to Information Disclosure (812262)
Date: 22
January 2002
Software: Microsoft Outlook 2002
Impact: Information
Disclosure
Max Risk: Moderate
Bulletin: MS03-003
----------------------------------------------------------------------
Bulletin: MS03-001 Issue:
======
The Microsoft Locator service is a name service that maps logical names to network-specific names. It ships with Windows NT 4.0, Windows 2000, and Windows XP.
By default, the Locator service is enabled only on Windows 2000 domain controllers and Windows NT 4.0 domain controllers; it is not enabled on Windows NT 4.0 workstations or member servers, Windows 2000 workstations or member servers, or Windows XP. A security vulnerability results from an unchecked buffer in the Locator service. By sending a specially malformed request to the Locator service, an attacker could cause the Locator service to fail, or to run code of the attacker's choice on the system.
Bulletin: MS03-002 Issue
======
Microsoft Content Management Server (MCMS) 2001 is an Enterprise Server product that simplifies developing and managing E-Commerce
web sites. MCMS includes a number of pre-defined ASP web pages that allow web site operators to quickly set up E-business websites.
A Cross-Site Scripting flaw exists in one of these ASP pages that could allow an attacker to insert script into the data being sent
to a MCMS server. Because the server generates a web page in response to a user request made using this page, it is possible that
the script could be embedded within the page that CMS generates and returns to the user, this script would then run when processed by
the user's browser. This could result in an attacker being able to access information the user shared with the legitimate site.
An attacker might attempt to exploit this flaw by crafting a malicious link to a valid site that the user intended to visit.
If the attacker were able to get a user to click the link-most likely by sending the link in an email-then it could be possible
for the attacker to take a variety of actions. The attacker could alter the data that appeared to be contained on the web pages
presented by the legitimate site, monitor the user's session with the legitimate site and copy personal data from the legitimate site
to a site under the attacker's control, or access the legitimate site's cookies.
Bulletin: MS03-003 Issue:
======
Microsoft Outlook 2002 provides the facility to encrypt e-mails sent between e-mail recipients. Encryption is used to prevent
parties other than the intended recipients from reading the contents of an e-mail. Outlook uses public key certificates to
facilitate the exchange of the cryptographic keys that are used in the encryption process, and Outlook offers a number of different
options as to what type of certificates can be used. S/MIME certificates are the most commonly used (and are not affected by
the vulnerability that is the subject of this bulletin), but there are other certificate options including V1 Exchange Server Security
certificates.
A vulnerability exists because there is a flaw in the way Outlook 2002 handles a V1 Exchange Server Security certificate when using
it to encrypt e-mail. As a result of this flaw, Outlook fails to encrypt the mail correctly and the message will be sent in plain
text. This could cause the information in the e-mail to be exposed when the user believed it to be protected through encryption.
Further information and patch availability:
|
|
|
 |
| "Advisories!: Microsoft Release Multiple Patches :: 22 January, 2003" | Login/Create an Account | 0 comments |
|
| | The comments are owned by the poster. We aren't responsible for their content. |
|
|
|
No Comments Allowed for Anonymous, please register |
|
| |
|
Login |
|
 |
|
|
|
|
· New User? · Click here to create a registered account.
|
|
|
Article Rating |
|
|
|
|
|
|
Average Score: 0
Votes: 0
|
|
|
