PT-2014-1687 · Microsoft · Xml Core Services+1

Christian Kulenkampff · Publicado 2014-06-10 · Atualizado 2018-10-12 · CVE-2014-1816

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services (aka MSXML) versions 3.0 through 6.0

Description The issue is related to the processing of XML content and allows attackers to gain access to confidential information. It does not properly restrict the information transmitted by Internet Explorer during a download action, enabling remote attackers to discover full pathnames on the client system and local usernames embedded in these pathnames via a crafted web site.

Recommendations For Microsoft XML Core Services (aka MSXML) versions 3.0 through 6.0, consider restricting the information transmitted by Internet Explorer during download actions to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of MSXML for handling XML content until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-00635

CVE-2014-1816

Produtos afetados

Internet Explorer

Xml Core Services

Referências · 8

• http://secunia.com/advisories/58538 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-033 · Aviso do Fabricante
• http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx · Aviso do Fabricante
• http://securityfocus.com/bid/67895 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1816 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1816 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms14-033 · Nota
• https://bdu.fstec.ru/vul/2015-00635 · Nota de Segurança