PT-2002-1757 · Microsoft · Backoffice

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0736

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft BackOffice versions 4.0 through 4.5

Description The issue allows remote attackers to bypass authentication and access administrative ASP pages via an HTTP request with a specific auth type that is not blank. This occurs when Microsoft BackOffice is configured to be accessible by other systems.

Recommendations For Microsoft BackOffice versions 4.0 through 4.5, consider restricting access to the administrative ASP pages until a fix is available. As a temporary workaround, avoid using HTTP requests with blank or specific auth type values to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0736

Affected Products

Backoffice

References · 5

• http://support.microsoft.com/support/kb/articles/q316/8/38.asp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0736 · Security Note
• http://iss.net/security_center/static/8862.php · Vendor Advisory
• http://securityfocus.com/bid/4528 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-04/0208.html · Note