Microsoft Internet Information Server (IIS) vulnerable to buffer overflow via inaccurate checking of delimiters in HTTP header fields

Overview A buffer overflow in IIS could allow an intruder to execute arbitrary code the the privileges of the ASP ISAPI extension. Description Like all web servers, IIS parses HTTP headers and decomposes them into the constituent parts. As part of this processing, IIS checks for delimiters that a...

Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure (MS02-023)

Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure MS02-023 source: https://www.securityfocus.com/bid/4411/info The Cascading Style-Sheets CSS interpreter for Microsoft Internet Explorer is prone to an issue which may allow an attacker to read the contents of files on a web...

Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure (MS02-023)

source: https://www.securityfocus.com/bid/4411/info The Cascading Style-Sheets CSS interpreter for Microsoft Internet Explorer is prone to an issue which may allow an attacker to read the contents of files on a web user's system. It is possible to use the cssText property of the styleSheet to rea...

Microsoft Security Bulletin MS02-005

---------------------------------------------------------------------- Title: 11 February 2002 Cumulative Patch for Internet Explorer Date: 11 February 2002 Software: Internet Explorer Impact: Run Code of Attacker's Choice Max Risk: Critical Bulletin: MS02-005 Microsoft encourages customers...

Security Bulletin MS01-060

---------------------------------------------------------------------- Title: SQL Server Text Formatting Functions Contain unchecked Buffers Date: 20 December 2001 Software: Microsoft SQL Server 7.0 and Microsoft SQL Server 2000 Impact: Run code of attacker's choice on server, denial of service...

IIS decodes filenames superfluously after applying security checks

Overview Microsoft IIS decodes filenames after applying security checks, allowing an attacker to execute commands. Description To accomodate complex URIs, RFC 2396 specifies a means to encode arbitrary octets using hexadecimal characters and the percent sign %. Quoting from RFC 2396: An escaped...

Microsoft Windows 2000 Workstation in mixed-mode domain may ignore domain account lockout restriction due to flaw in NTLM authentication

Overview A flaw in certain configurations of Windows 2000 can allow an intruder to make an unlimited number of guesses to attempt to determine a password, despite policies intended to limit the number of guesses. Description Domain administrators can set policies governing certain aspects of...

Security Bulletin (MS01-004)

---------------------------------------------------------------------- - - Title: Patch Available to Eliminate New Variant of "File Fragment Reading via .HTR" Vulnerability Date: 29 January 2001 Software: IIS 4.0 and 5.0 Impact: File Reading Bulletin: MS01-004 KB Article: Q285985 available soon...

Security Bulletin MS01-002

--------------------------------------------------------------------- Title: PowerPoint File Parsing Vulnerability Date: January 22, 2001 Software: PowerPoint 2000 Impact: Execution of Arbitrary Code Bulletin: MS01-002 Microsoft encourages customers to review the Security Bulletin at:...

Exploit Code for File Input field advisory.

I have coded an exploit example for the "File Upload via Form" vulnerability recently mentioned by Microsoft Security. Here's the source for it well, most of the source. If you would like the whole source, email me. I'll send it as an attachment. --------------snip------------------ !script...

Security Bulletin (MS00-093)

Microsoft Security Bulletin MS00-093 Patch Available for "Browser Print Template" and "File Upload via Form" Vulnerabilities Originally posted: December 01, 2000 Summary Microsoft has released a patch that eliminates four security vulnerabilities in Microsoft® Internet Explorer: The “Browser Prin...

Re-release: Microsoft Security Bulletin MS00-086

============================================================ Issue: Regression error in IIS 5.0 patch re-exposes previous vulnerability. Date: November 30, 2000 Affected Software: IIS 5.0 Impact: Execute system commands on server Bulletin ID: MS00-086 Bulletin:...

Windows 2000 Telnet Service DoS

Below is the original message sent to Microsoft, and since apparently 'Disclosure Procedures' are once again in focus... 11/08/2000 - Issue is reported to Microsoft's Security Response Team [email protected] 11/10/2000 - Microsoft confirmed receipt 11/21/2000 - Microsoft responded that they...

IIS 5.0 with patch Q277873 allows executing arbitrary commands on the web server

A recent report http://www.securityfocus.com/archive/1/147109 suggests that; http://IISServer/scripts/somefile.bat/..C19C..C19C..C19Cwinnt/system32 /cmd.exe?/c20dir20C: wrapped might yield a directory listing on IIS 5.0 boxes that have applied the fix listed in Microsoft Security Bulletin MS00-08...

Security Bulletin (MS00-088)

The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. -----BEGIN PGP SIGNED MESSAGE----- Microsoft Security Bulletin MS00-088 - -------------------------------------- Patch...

Update to Microsoft Security Bulletin MS00-086

-----BEGIN PGP SIGNED MESSAGE----- Hi All - We have updated Microsoft Security Bulletin MS00-086 http://www.microsoft.com/technet/security/bulletin/MS00-086.asp, to provide the following additional information: There is an additional restriction on the vulnerability. As originally reported, the...

MS Outlook "Cache Bypass" allows attackers to circumvent Internet Zone security policy

Overview Microsoft has recently released Microsoft Security Bulletin MS00-046, in which they announced a patch for the "Cache Bypass" vulnerability. By exploiting this vulnerability, an attacker can use an HTML-formatted message to read certain types of files on the victim's machine. In addition,...

Security Bulletin (MS00-070)

The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. -----BEGIN PGP SIGNED MESSAGE----- Microsoft Security Bulletin MS00-070 - -------------------------------------- Patch...

RE: Re[3]: Possible Exchange 5.5 Server DoS [msrc 421]

Hello 3APA3A, Thanks again for your note. Due to the timeframe of Exchange SP4 we will including a fix for this issue in that Service Pack. If you want any future status on this issue please refer to MSRC 421. Regards, [email protected] -----Original Message----- From: 3APA3A...

Microsoft refuses to fix a security bug in Windows 2000

Microsoft refuses to fix a security bug in Windows 2000 Eugene Kalinin Medical Informatics Laboratory Moscow, Russia Aug 16, 2000 Yesterday Microsoft refused to fix a security problem in Windows 2000 RPC service. The bug in RPC service allows an attacker to put a Windows 2000 server out of servic...