PT-2015-1068 · Microsoft · Windows+1

Published 2015-04-14 · Updated 2018-10-12 · CVE-2015-1646

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services (aka MSXML) 3.0

Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD. This vulnerability is related to a component of the Windows operating system, specifically XML Core Services, and is associated with the possibility of cross-domain access to data when declaring document types. This enables attackers to access confidential user data, such as names, passwords, or files on the hard drive.

Recommendations For Microsoft XML Core Services (aka MSXML) 3.0, consider disabling the use of crafted DTDs as a temporary workaround until a patch is available. Restrict access to sensitive user data to minimize the risk of exploitation. Avoid using MSXML 3.0 for processing untrusted XML documents until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09928

CVE-2015-1646

Affected Products

Xml Core Services

Windows

References · 6

• https://bdu.fstec.ru/vul/2015-09928 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-039 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1646 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1646 · Security Note
• http://securitytracker.com/id/1032114 · Note
• http://technet.microsoft.com/security/bulletin/ms15-039 · Note