PT-2002-1757 · Microsoft · Backoffice

Publicado 2002-08-12 · Atualizado 2008-09-05 · CVE-2002-0736

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft BackOffice versions 4.0 through 4.5

Description The issue allows remote attackers to bypass authentication and access administrative ASP pages via an HTTP request with a specific auth type that is not blank. This occurs when Microsoft BackOffice is configured to be accessible by other systems.

Recommendations For Microsoft BackOffice versions 4.0 through 4.5, consider restricting access to the administrative ASP pages until a fix is available. As a temporary workaround, avoid using HTTP requests with blank or specific auth type values to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-0736

Produtos afetados

Backoffice

Referências · 5

• http://support.microsoft.com/support/kb/articles/q316/8/38.asp · Aviso do Fabricante
• http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0736 · Nota de Segurança
• http://iss.net/security_center/static/8862.php · Aviso do Fabricante
• http://securityfocus.com/bid/4528 · Aviso do Fabricante