PT-2014-1687 · Microsoft · Xml Core Services+1

Christian Kulenkampff · Published 2014-06-10 · Updated 2018-10-12 · CVE-2014-1816

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services (aka MSXML) versions 3.0 through 6.0

Description The issue is related to the processing of XML content and allows attackers to gain access to confidential information. It does not properly restrict the information transmitted by Internet Explorer during a download action, enabling remote attackers to discover full pathnames on the client system and local usernames embedded in these pathnames via a crafted web site.

Recommendations For Microsoft XML Core Services (aka MSXML) versions 3.0 through 6.0, consider restricting the information transmitted by Internet Explorer during download actions to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of MSXML for handling XML content until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-00635

CVE-2014-1816

Affected Products

Internet Explorer

Xml Core Services

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-033 · Vendor Advisory
• http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1816 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1816 · Security Note
• https://bdu.fstec.ru/vul/2015-00635 · Security Note
• http://secunia.com/advisories/58538 · Note
• http://securityfocus.com/bid/67895 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-033 · Note