PT-2008-5348 · Microsoft · Xml Core Services+3

Stefano Di Paola · Published 2008-11-12 · Updated 2018-10-12 · CVE-2008-4033

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions 3.0 through 6.0

Description The issue allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, such as the Transfer-Encoding field. This could enable an attacker to read data from a Web page in another domain in Internet Explorer if a user browses a Web site that contains specially crafted content or opens specially crafted HTML e-mail.

Recommendations For Microsoft XML Core Services versions 3.0 through 6.0, consider disabling the handling of Transfer-Encoding headers as a temporary workaround until a patch is available. Restrict access to specially crafted Web sites and HTML e-mail to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-4033

Affected Products

Internet Explorer

Xml Core Services

Office

Office Visio

References · 12

• 🔥 https://exploit-db.com/exploits/7196 · Exploit
• http://securityfocus.com/bid/32204 · Patch
• http://marc.info/?l=bugtraq&m=122703006921213&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4033 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4033 · Security Note
• http://securitytracker.com/id?1021164 · Note
• http://us-cert.gov/cas/techalerts/TA08-316A.html · Note
• http://vupen.com/english/advisories/2008/3111 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5847 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-069 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4033 · Note