Microsoft Management Console cross-site scripting vulnerability

Overview

Microsoft Management Console (MMC) is vulnerable to cross-site scripting, which may allow a remote attacker to execute arbitrary code on a vulnerable system.

Description

MMC

MMC is an application that allows a user to perform administrative tasks. Through the use of various snap-ins, MMC can be used to configure Windows services, local users and groups, storage devices, and more.

** The problem**

HTML files in the MMC library can be directly referenced by Internet Explorer. This can cause a cross-site scripting vulnerability from other zones into the Local Machine Zone.

---

Impact

By convincing a user to view a specially crafted HTML document (e.g., a web page, an HTML email message, or an email attachment), an attacker could execute arbitrary code with the privileges of the user.

---

Solution

Apply an update
This vulnerability is addressed in Microsoft Security Bulletin MS06-044.

---

Workarounds

Microsoft has provided several workarounds in Microsoft Security Bulletin MS06-044.

---

Vendor Information

927548

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: August 08, 2006

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see Microsoft Security Bulletin MS06-044.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23927548 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/ms06-044.mspx&gt;
• <http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/mmcsteps.mspx&gt;

Acknowledgements

This vulnerability was reported by Microsoft, who in turn credit Yorick Koster of ITsec Security Services, H D Moore, and Tom Gilder.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2006-3643
Severity Metric:	12.15 Date Public: