Microsoft XML Core Services Information Disclosure and Code Execution - Secunia Advisories - Vulnerability Intelligence

Microsoft XML Core Services Information Disclosure and Code Execution
Secunia Advisory:	SA22333	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2006-10-10
Last Update:	2006-10-24
Popularity:	9,512 views

Critical:	Highly critical
Impact:	Exposure of sensitive information System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	Microsoft XML Core Services (MSXML) 3.x Microsoft XML Core Services (MSXML) 4.x Microsoft XML Core Services (MSXML) 6.x Microsoft XML Parser 2.x

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2006-4685 CVE-2006-4686

Description: Two vulnerabilities have been reported in Microsoft XML Core Services, which can be exploited by malicious people to disclose certain information and compromise a vulnerable system. 1) An unspecified error exists in the XMLHTTP ActiveX control when interpreting a HTTP server-side redirect. This can be exploited to disclose certain information e.g. via a specially crafted web page. 2) A boundary error exists in the XSLT processing in MSXML. This can be exploited to cause a buffer overflow via a specially crafted web page and allows execution of arbitrary code. Solution: Apply patches. Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Windows 2000 SP4: http://www.microsoft.com/downloads/de...=f9d16d74-1785-4c33-b1fc-df5258dd1089 Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP SP1: http://www.microsoft.com/downloads/de...=8a455c3b-213c-4395-87e9-9895f2b9a6ed Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP SP2: http://www.microsoft.com/downloads/de...=8a455c3b-213c-4395-87e9-9895f2b9a6ed Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows XP Professional x64 Edition: http://www.microsoft.com/downloads/de...=5593333f-bcd5-4750-a23d-4f7fccda6493 Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003: http://www.microsoft.com/downloads/de...=09b77b2a-a4fd-46e2-af15-2385790c9ee7 Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 SP1: http://www.microsoft.com/downloads/de...=09b77b2a-a4fd-46e2-af15-2385790c9ee7 Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems: http://www.microsoft.com/downloads/de...=31c88513-29df-475b-b9ae-a2f5c1f32a8c Microsoft XML Parser 2.6 (all versions) and Microsoft XML Core Services 3.0 (all versions) on Microsoft Windows Server 2003 x64 Edition: http://www.microsoft.com/downloads/de...=6183a9d2-89f5-4b25-be8b-090c6e050740 Microsoft Office 2003 Service Pack 1 or Service Pack 2 with Microsoft XML Core Services 5.0 SP1: http://www.microsoft.com/downloads/de...=8A37C111-D8E9-4C2E-9674-169B3331491C Microsoft XML Core Services 4.0 on Windows 2000 SP4: http://www.microsoft.com/downloads/de...=961f3c95-ec4e-4561-ab27-b3180e9139c5 Microsoft XML Core Services 4.0 on Microsoft Windows XP SP1 and Microsoft Windows XP SP2: http://www.microsoft.com/downloads/de...=961f3c95-ec4e-4561-ab27-b3180e9139c5 Microsoft XML Core Services 4.0 on Microsoft Windows Server 2003 and Microsoft Windows Server 2003 SP1: http://www.microsoft.com/downloads/de...=961f3c95-ec4e-4561-ab27-b3180e9139c5 Microsoft XML Core Services 6.0 on Windows 2000 SP4: http://www.microsoft.com/downloads/de...=fd513435-fa6d-407c-bedc-5fd03e5b7d6c Microsoft XML Core Services 6.0 on Microsoft Windows XP SP1 and Microsoft Windows XP SP2: http://www.microsoft.com/downloads/de...=fd513435-fa6d-407c-bedc-5fd03e5b7d6c Microsoft XML Core Services 6.0 on Microsoft Windows Server 2003 and Microsoft Windows Server 2003 SP1: http://www.microsoft.com/downloads/de...=fd513435-fa6d-407c-bedc-5fd03e5b7d6c Provided and/or discovered by: Reported by the vendor. Changelog: 2006-10-11: Added link to US-CERT. 2006-10-13: Added link to US-CERT. 2006-10-24: Microsoft has re-released the security update for Windows 2000 SP4 where the previous update did not correctly set the kill bit for Microsoft XML Parser 2.6. Original Advisory: MS06-061 (KB924191): http://www.microsoft.com/technet/security/Bulletin/MS06-061.mspx Other References: US-CERT VU#703936: http://www.kb.cert.org/vuls/id/703936 US-CERT VU#562788: http://www.kb.cert.org/vuls/id/562788

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

Today

New advisories:	9
New vulnerabilities:	13
Updated advisories:	17

Not // 92 views

DAHDI "ZT_SPANCONFIG" IOCTL Privilege Escalation Vulnerability

Not // 94 views

Zaptel "ZT_SPANCONFIG" IOCTL Privilege Escalation Vulnerabilities

Moderately // 103 views

Rumpus Multiple Vulnerabilities

Less // 112 views

bcoos "cid" SQL Injection Vulnerability

Moderately // 101 views

ASP Portal "ASPPortal.mdb" Database Disclosure Security Issue

Moderately // 161 views

Ubuntu update for imagemagick

Moderately // 148 views

Ubuntu update for libvorbis

Less // 144 views

Debian update for phpmyadmin

Moderately // 304 views

ClamAV "cli_check_jpeg_expl oit()" Denial of Service Vulnerability

1st Dec, 2008

New advisories:	33
New vulnerabilities:	55
Updated advisories:	56

Moderately // 380 views

RakhiSoftware Shopping Cart Multiple Vulnerabilities

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.