SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Microsoft)  >   Windows DLL (Any) Vendors:   Microsoft
Microsoft MHTML Input Validation Hole May Permit Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1025003
SecurityTracker URL:  http://securitytracker.com/id/1025003
CVE Reference:   CVE-2011-0096   (Links to External Site)
Updated:  Apr 12 2011
Original Entry Date:  Jan 28 2011
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 2003 SP2, Vista SP2, 2008 SP2, 2008 R2 SP1, XP SP3, 7 SP1; and prior service packs
Description:   A vulnerability was reported in Microsoft MHTML. A remote user can conduct cross-site scripting attacks.

MHTML does not properly process MIME-formatted requests for content blocks within a document. A remote user may be able to inject a client-side script in the response of a Web request running in the context of the target user's Internet Explorer.

[On March 11, 2011, the vendor updated their advisory to indicate that this vulnerability is being actively exploited in limited attacks.]

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the target site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has issued the following fixes:

Windows XP Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=7F0A4616-8E3E-4925-9D95-CE6E614E45AE

Windows XP Professional x64 Edition Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=B01FE9A5-66A4-4683-963B-E78AEA214579

Windows Server 2003 Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=0209A004-F23A-40D9-991F-864046F4605F

Windows Server 2003 x64 Edition Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=6C287571-54EA-4298-8B7D-B98B2C830CC3

Windows Server 2003 with SP2 for Itanium-based Systems:

http://www.microsoft.com/downloads/details.aspx?familyid=3FB450A0-D087-4F36-9301-05FFBF94CC1A

Windows Vista Service Pack 1 and Windows Vista Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=C8FCE0FB-4C90-479B-8CE9-75E60D52D256

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=7DA10B64-D0A9-4E42-AA3A-87C657122A8C

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=036F1285-7484-4E3B-8799-2C6C08166596

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=1438CEC8-8DAB-4510-AD75-DC6959DAC0D8

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=F35ECDD1-6B5C-40E7-A00B-CA083BDF5CBA

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=AED201C1-F1FB-4DF9-8875-6F57EA0EB15B

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=1A32BF04-7EED-4D27-A8E4-054B4A5B76CB

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=665FAA7E-2368-4421-9DD5-EA6DF2C79498

Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=140EA384-2877-401F-AC3B-F84F6966E970

A restart is required.

The Microsoft advisories are available at:

http://www.microsoft.com/technet/security/bulletin/ms11-026.mspx
http://www.microsoft.com/technet/security/advisory/2501696.mspx

Vendor URL:  www.microsoft.com/technet/security/bulletin/ms11-026.mspx (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC