PT-2015-1068 · Microsoft · Windows+1

Publicado 2015-04-14 · Atualizado 2018-10-12 · CVE-2015-1646

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services (aka MSXML) 3.0

Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD. This vulnerability is related to a component of the Windows operating system, specifically XML Core Services, and is associated with the possibility of cross-domain access to data when declaring document types. This enables attackers to access confidential user data, such as names, passwords, or files on the hard drive.

Recommendations For Microsoft XML Core Services (aka MSXML) 3.0, consider disabling the use of crafted DTDs as a temporary workaround until a patch is available. Restrict access to sensitive user data to minimize the risk of exploitation. Avoid using MSXML 3.0 for processing untrusted XML documents until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-09928

CVE-2015-1646

Produtos afetados

Xml Core Services

Windows

Referências · 6

• https://bdu.fstec.ru/vul/2015-09928 · Nota de Segurança
• http://securitytracker.com/id/1032114 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-039 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1646 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-039 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1646 · Nota de Segurança