Microsoft Security Bulletin MS03-002: Cumulative Patch for Microsoft Content Management Server (810487)

2003-01-23T00:00:00
ID SECURITYVULNS:DOC:4014
Type securityvulns
Reporter Securityvulns
Modified 2003-01-23T00:00:00

Description

-----BEGIN PGP SIGNED MESSAGE-----


Title: Cumulative Patch for Microsoft Content Management Server (810487) Date: 22 January 2003 Software: Microsoft Content Management Server 2001 Impact: Information Disclosure Max Risk: Moderate Bulletin: MS03-002

Microsoft encourages customers to review the Security Bulletins at: http://www.microsoft.com/technet/security/bulletin/MS03-002.asp http://www.microsoft.com/security/security_bulletins/ms03-002.asp


Issue:

Microsoft Content Management Server (MCMS) 2001 is an Enterprise Server product that simplifies developing and managing E-Commerce web sites. MCMS includes a number of pre-defined ASP web pages that allow web site operators to quickly set up E-business websites.

A Cross-Site Scripting flaw exists in one of these ASP pages that could allow an attacker to insert script into the data being sent to a MCMS server. Because the server generates a web page in response to a user request made using this page, it is possible that the script could be embedded within the page that CMS generates and returns to the user, this script would then run when processed by the user's browser. This could result in an attacker being able to access information the user shared with the legitimate site.

An attacker might attempt to exploit this flaw by crafting a malicious link to a valid site that the user intended to visit. If the attacker were able to get a user to click the link-most likely by sending the link in an email-then it could be possible for the attacker to take a variety of actions. The attacker could alter the data that appeared to be contained on the web pages presented by the legitimate site, monitor the user's session with the legitimate site and copy personal data from the legitimate site to a site under the attacker's control, or access the legitimate site's cookies.

Mitigating Factors:

  • This flaw is not present in Microsoft Content Management Server 2002.
  • The attacker would have no way to force users to visit the malicious site. Instead, the attacker would need to lure them there, typically by getting them to click on a link that would take them to the attacker's site.

Risk Rating:

  • Moderate

Patch Availability:

  • A patch is available to fix this vulnerability. Please read the Security Bulletins at http://www.microsoft.com/technet/security/bulletin/ms03-002.asp http://www.microsoft.com/security/security_bulletins/ms03-002.asp

for information on obtaining this patch.


THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

-----BEGIN PGP SIGNATURE----- Version: PGP 7.1

iQEVAwUBPi7heI0ZSRQxA/UrAQEmzAgAgID/nmgK4Azm+gzggSq5H3O3eg0jJ9IX BTK1PUMnJtbQGTftRXgNKeKox/vJfnmVPiz2mm0XVXpA8FhYD8PFZzgzf1CRjy6u xw+Z/BNKF2thkwP3vCCdArHk+cDQukaMQPjSB7Pq7GdAo2gjlnomnIEXpjxogGYr LMyjKL2Z5YkgJjdYMF2BIsrSdnMtyH551K9/+gUSy5C9KDCKFbmfAFWFdIwouzad iF6g+STuFagTXycvFKitY1lauTqGtiVEzTACbwfQmfGNZgMWHMHMMnaBj/VAXWI/ DJFcDVGMYjk3y6hxSkvUvVQb4/oJEVuwuDuCsNhnAtjIOXh/5AneLQ== =qa7Y -----END PGP SIGNATURE-----


You have received this e-mail bulletin because of your subscription to the Microsoft Product Security Notification Service. For more information on this service, please visit http://www.microsoft.com/technet/security/notify.asp.

To verify the digital signature on this bulletin, please download our PGP key at http://www.microsoft.com/technet/security/notify.asp.

To unsubscribe from the Microsoft Security Notification Service, please visit the Microsoft Profile Center at http://register.microsoft.com/regsys/pic.asp

If you do not wish to use Microsoft Passport, you can unsubscribe from the Microsoft Security Notification Service via email as described below: Reply to this message with the word UNSUBSCRIBE in the Subject line.

For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security.