Microsoft Jet Database Engine databasefil fortolknings-sårbarhed - Advisories

Software Inspectors

	Scan Online

	Personal (PSI)

	Network (NSI 2.0) - NEW -

Solutions For

	Security Professionals

	Security Vendors

Free Solutions For

	Open Communities

	Journalists & Media

Secunia Advisories

	Search

	Historic Advisories

	Listed By Product

	Listed By Vendor

	Statistics / Graphs

	Secunia Research

	Report Vulnerability

	About Advisories

Virus Information

	Chronological List

	Last 10 Virus Alerts

	About Virus Information

Secunia Customers

	Customer Area

Microsoft Jet Database Engine databasefil fortolknings-sårbarhed

Secunia Advisory:	SA14896
Udsendt:	2005-04-12
Sidste Opdt.:	2005-10-04

Kritisk:	Meget kritisk
Betydning:	Systemadgang
Hvor:	Fra Internet
Løsning Status:	Ikke Patchet

OS:	Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Professional Microsoft Windows 2000 Server Microsoft Windows Server 2003 Datacenter Edition Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows Storage Server 2003 Microsoft Windows XP Home Edition Microsoft Windows XP Professional

Software:	Microsoft Office 2000 Microsoft Office 2003 Professional Edition Microsoft Office 2003 Small Business Edition Microsoft Office 2003 Standard Edition Microsoft Office 2003 Student and Teacher Edition Microsoft Office 2007 Microsoft Office Word 2007 Microsoft Office XP Microsoft Word 2000 Microsoft Word 2002 Microsoft Word 2003

CVE reference:	CVE-2005-0944 (Secunia mirror) CVE-2007-6026 (Secunia mirror) CVE-2008-1092 (Secunia mirror)

	This advisory is currently marked as unpatched! - Companies can be alerted when a patch is released!

Beskrivelse: HexView har fundet en sårbarhed i Microsoft Jet Database Engine, som kan udnyttes af ondsindede personer til at kompromittere en brugers system. Sårbarheden skyldes en hukommelses-håndteringsfejl under f.eks. fortolkningen af database-filer. Dette kan udnyttes til at eksekvere vilkårlig kode ved at lokke en bruger til at åbne en specielt udformet ".mdb" fil i Microsoft Access. NOTE: Exploit-kode er lagt ud på offentligt tilgængelige mailing-lister. Sårbarheden er bekræftet på et fuldt opdateret system med Microsoft Access 2003 (msjet40.dll version 4.00.8618.0) og Microsoft Windows XP SP1/SP2. Andre versioner kan også være berørte. Løsning: Åbn ikke ".mdb" databasefiler, der ikke haves fuld tillid til. Rapporteret af / Kredit: HexView Forløb: 04-10-2005: Tilføjede link til US-CERT. Original Advisory: http://www.hexview.com/docs/20050331-1.txt Andre Kilder: US-CERT VU#176380: http://www.kb.cert.org/vuls/id/176380



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

306 Relaterede Secunia Advisories, displaying 10

1. Microsoft Excel kode eksekvering

2. Microsoft Windows LSASS rettighedseskalering

3. Microsoft Windows TCP/IP-implementation sårbarheder

4. Microsoft Windows Message Queuing Service buffer overflow

5. Windows Media Format Runtime ASF-fortolkningssårbarhed

6. Microsoft Windows Message Queuing Service rettighedseskalering

7. Microsoft DirectX SAMI/WAV/AVI fil-fortolkning sårbarheder

8. Microsoft "Web Proxy Auto-Discovery" feature sikkerhedsproblem

9. Microsoft Windows DNS-service cache-forgiftning

10. Macrovision SafeDisc secdrv.sys rettighedseskalering

Vis alle relaterede advisories

Send Feedback to Secunia

Hvis du har ny information angående dette Secunia advisory eller et produkt i vores database, så send det venligst til os. Du kan sende det til os enten ved at bruge vores web formular eller ved at sende det til vuln@secunia.com. Ideer, foreslag og andet feedback er også meget velkommen.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	SAP Internet Transaction Server wgate.dll Cross-Site Scripting Vulnerability

2.	Yahoo! Assistant yNotifier.dll ActiveX Control Code Execution

3.	Slackware update for thunderbird

4.	Cyberfolio "rep" File Inclusion Vulnerability

5.	Ubuntu update for gst-plugins-goo d0.10

6.	Zarafa Script Insertion Vulnerabilities

7.	Ubuntu update for vorbis-tools

8.	OpenKM Document Export Security Issue

9.	vShare YouTube Clone "tid" SQL Injection Vulnerability

10.	TFTP Server SP Long Error Message Buffer Overflow