DHTML Edit Control for IE5 allows local files to be uploaded to web server

Overview A vulnerability exists in the DHTML Edit Control for IE5 that allows arbitrary local files to be uploaded to a web server. Description DHTML Edit is an activex control that is marked safe-for-scripting. This control can be embedded in a website, and permit local files to be remotely...

Microsoft Visual FoxPro fails to properly evaluate filenames before launching application

Overview There is a vulnerability in Microsoft Visual FoxPro 6.0 that allows remote attackers to execute Visual FoxPro applications with the privileges of the victim user. Description Microsoft Visual FoxPro 6.0 contains an unspecified vulnerability that allows remote attackers to execute arbitra...

Microsoft SQL Server installation process leaves sensitive information on system

Overview Microsoft SQL server versions 7.0 and 2000, as well as MSDE 1.0, may leave installation and log files on the server after the installation process is complete. These files may contain senstitive information such as passwords used during the install. Users with authenticated access to the...

Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service

Overview Microsoft SQL Server 2000 contains a remotely exploitable stack buffer overflow that allows attackers to execute arbitrary code with the same privileges as the SQL server. Description The SQL Server Resolution Service SSRS was introduced in Microsoft SQL Server 2000 to provide referral...

Microsoft Windows 2000 Network Dynamic Data Exchange (DDE) executes code as Local System

Overview The Windows 2000 Network DDE agent permits local users to execute commands with system privileges. Description Dynamic Data Exchange DDE is an interprocess communication mechanism used in Microsoft Windows. A DDE share is an area of memory which is used to store and retrieve data. Networ...

Microsoft SQLXML ISAPI filter vulnerable to buffer overflow via contenttype parameter

Overview A buffer overflow vulnerability exists in the Microsoft SQLXML Internet Services Application Programming Interface ISAPI extension for Internet Information Server IIS. This vulnerability could allow a remote attacker to cause a denial of service or execute arbitrary code with LocalSystem...

Microsoft Remote Access Service API contains buffer overflow vulnerability via phonebook entries

Overview The Microsoft Remote Access Service API contains a vulnerability that allows local attackers to execute arbitrary code with system privileges. Description The Microsoft Remote Access Service RAS Application Programming Interface API allows Windows programs to make dial-up connections to...

Microsoft Internet Explorer may handle certain web pages in an incorrect, less restrictive security zone (MS02-023)

Overview Microsoft Internet Explorer IE may handle malformed Internet pages accessed through the NetBIOS protocol as if they belong to the IE's Intranet or Trusted Sites security zones, instead of the more restrictive Internet security zone. Description If a user views a page on the Internet that...

More Office XP problems (version 3.0)

Georgi Guninski security advisory 53 Version 3.0, 2002 More Office XP problems Systems affected: Office XP Risk: High Date: 31 March 2002 Updated: 3 April 2002 check corrections, 3 is added Updated: 28 April 2002 check corrections, 4 is added Legal Notice: This Advisory is Copyright c 2002 Georgi...

Special DOS device DoS against Microsoft Outlook Express

Summary: ======== Affected: Outlook Express 5.5, 6.0 with all fixes Not tested: Microsoft Outlook Vendor: Microsoft Risk: Average Remote: Yes Exploitable: Yes Description: ========== Outlook Express hangs on HTML message with BGSOUND or IFRAME tag pointing to special device. Outlook Express will...

MS02-018: Cumulative Patch for Internet Information Services (327696)

The remote version of Windows contains multiple flaws in the Internet Information Service IIS, such as heap overflow, DoS, and XSS that could allow an attacker to execute arbitrary code on the remote host with SYSTEM privileges. C Tenable Network Security, Inc. include"compat.inc"; if description...

[SNS Advisory No.49] A Possibility of Internet Information Server/Services Cross Site Scripting

---------------------------------------------------------------------- SNS Advisory No.49 A Possibility of Internet Information Server/Services Cross Site Scripting Problem first discovered: Fri, 11 Jan 2002 Published: Thu, 11 Apr 2002...

Microsoft Internet Information Server (IIS) vulnerable to buffer overflow via inaccurate checking of delimiters in HTTP header fields

Overview A buffer overflow in IIS could allow an intruder to execute arbitrary code the the privileges of the ASP ISAPI extension. Description Like all web servers, IIS parses HTTP headers and decomposes them into the constituent parts. As part of this processing, IIS checks for delimiters that a...

Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure (MS02-023)

Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure MS02-023 source: https://www.securityfocus.com/bid/4411/info The Cascading Style-Sheets CSS interpreter for Microsoft Internet Explorer is prone to an issue which may allow an attacker to read the contents of files on a web...

Microsoft Internet Explorer 5 - Cascading Style Sheet File Disclosure (MS02-023)

source: https://www.securityfocus.com/bid/4411/info The Cascading Style-Sheets CSS interpreter for Microsoft Internet Explorer is prone to an issue which may allow an attacker to read the contents of files on a web user's system. It is possible to use the cssText property of the styleSheet to rea...

Microsoft Security Bulletin MS02-005

---------------------------------------------------------------------- Title: 11 February 2002 Cumulative Patch for Internet Explorer Date: 11 February 2002 Software: Internet Explorer Impact: Run Code of Attacker's Choice Max Risk: Critical Bulletin: MS02-005 Microsoft encourages customers...

Security Bulletin MS01-060

---------------------------------------------------------------------- Title: SQL Server Text Formatting Functions Contain unchecked Buffers Date: 20 December 2001 Software: Microsoft SQL Server 7.0 and Microsoft SQL Server 2000 Impact: Run code of attacker's choice on server, denial of service...

IIS decodes filenames superfluously after applying security checks

Overview Microsoft IIS decodes filenames after applying security checks, allowing an attacker to execute commands. Description To accomodate complex URIs, RFC 2396 specifies a means to encode arbitrary octets using hexadecimal characters and the percent sign %. Quoting from RFC 2396: An escaped...

Microsoft Windows 2000 Workstation in mixed-mode domain may ignore domain account lockout restriction due to flaw in NTLM authentication

Overview A flaw in certain configurations of Windows 2000 can allow an intruder to make an unlimited number of guesses to attempt to determine a password, despite policies intended to limit the number of guesses. Description Domain administrators can set policies governing certain aspects of...

Security Bulletin (MS01-004)

---------------------------------------------------------------------- - - Title: Patch Available to Eliminate New Variant of "File Fragment Reading via .HTR" Vulnerability Date: 29 January 2001 Software: IIS 4.0 and 5.0 Impact: File Reading Bulletin: MS01-004 KB Article: Q285985 available soon...