PT-2006-1123 · Microsoft · Indexing Services+1

Eiji James Yoshida · Published 2006-09-12 · Updated 2019-04-30 · CVE-2006-0032

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000, XP, and Server 2003

Description: A cross-site scripting issue exists due to the Indexing Service in Microsoft Windows. When the Encoding option is set to Auto Select, remote attackers can inject arbitrary web script or HTML via a UTF-7 encoded URL. This encoded URL is then injected into an error message with a charset set to UTF-7.

Recommendations: For Microsoft Windows 2000, XP, and Server 2003, consider disabling the Indexing Service or setting the Encoding option to a value other than Auto Select to mitigate the risk of exploitation. Restrict access to the Indexing Service to minimize the risk of remote attackers injecting arbitrary web script or HTML.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-0032

Affected Products

Indexing Services

Windows

References · 15

• 🔥 https://exploit-db.com/exploits/28500 · Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-053 · Vendor Advisory
• http://securityfocus.com/archive/1/446630/100/100/threaded · Vendor Advisory
• http://securityfocus.com/bid/19927 · Patch
• http://secunia.com/advisories/21861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0032 · Security Note
• http://kb.cert.org/vuls/id/108884 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28651 · Note
• http://securitytracker.com/id?1016826 · Note
• http://geocities.jp/ptrs_sec/advisory09e.html · Note
• http://vupen.com/english/advisories/2006/3564 · Note
• http://us-cert.gov/cas/techalerts/TA06-255A.html · Note
• http://securityfocus.com/archive/1/447511/100/0/threaded · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A535 · Note
• http://securityfocus.com/archive/1/447509/100/0/threaded · Note