7.5 - MS03-008

Executive Summary

Informations
Name	MS03-008	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Flaw in Windows Script Engine Could Allow Code Execution (814078)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:134

Oval ID:	oval:org.mitre.oval:def:134
Title:	Windows Script Engine Heap Overflow (Test 4)
Description:	Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2003-0010	Version:	5
Platform(s):	Microsoft Windows 2000	Product(s):	Windows Script Engine for Jscript
Definition Synopsis:
detected unpatched jscript.dll v5.1 Jscript.dll for JScript 5.1 or later is installed AND the version of jscript.dll is less than 5.1.0.8513 OR detected unpatched jscript.dll v5.5 the version of Jscript.dll is greater than or equal to 5.5.0.0 AND the version of jscript.dll is less than 5.5.0.8513 OR detected unpatched jscript.dll v5.6 the version of Jscript.dll is greater than or equal to 5.6.0.0 AND the version of jscript.dll is less than 5.6.0.8513

Definition Id: oval:org.mitre.oval:def:200

Oval ID:	oval:org.mitre.oval:def:200
Title:	DEPRECATED: Windows Script Engine Heap Overflow (Test 1)
Description:	Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2003-0010	Version:	7
Platform(s):	Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Windows Script Engine for JScript v5.6
Definition Synopsis:
Software section the version of jscript.dll is less than 5.6.0.8513 AND NOT Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND NOT the patch js56nen.exe (5.6.0.8513 version) is installed AND Configuration section active scripting is enabled current user settings are being used and active scripting is enabled NOT use machine settings rather than individual user settings AND active scripting is enabled for the current user OR local machine settings are being used and active scripting is enabled use machine settings rather than individual user settings AND active scripting is enabled for the local machine

Definition Id: oval:org.mitre.oval:def:794

Oval ID:	oval:org.mitre.oval:def:794
Title:	DEPRECATED: Windows Script Engine Heap Overflow (Test 2)
Description:	Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2003-0010	Version:	7
Platform(s):	Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000	Product(s):	Windows Script Engine for JScript v5.1
Definition Synopsis:
Software section the version of jscript.dll is less than 5.1.0.8513 AND NOT Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND NOT the patch js56nen.exe (5.1.0.8513 version) is installed AND Configuration section active scripting is enabled current user settings are being used and active scripting is enabled NOT use machine settings rather than individual user settings AND active scripting is enabled for the current user OR local machine settings are being used and active scripting is enabled use machine settings rather than individual user settings AND active scripting is enabled for the local machine

Definition Id: oval:org.mitre.oval:def:795

Oval ID:	oval:org.mitre.oval:def:795
Title:	DEPRECATED: Windows Script Engine Heap Overflow (Test 3)
Description:	Integer overflow in JsArrayFunctionHeapSort function used by Windows Script Engine for JScript (JScript.dll) on various Windows operating system allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value that enables a heap-based buffer overflow attack.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2003-0010	Version:	7
Platform(s):	Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000	Product(s):	Windows Script Engine for JScript v5.5
Definition Synopsis:
Software section the version of jscript.dll is less than 5.5.0.8513 AND NOT Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND NOT the patch js56nen.exe (5.5.0.8513 version) is installed AND Configuration section active scripting is enabled current user settings are being used and active scripting is enabled NOT use machine settings rather than individual user settings AND active scripting is enabled for the current user OR local machine settings are being used and active scripting is enabled use machine settings rather than individual user settings AND active scripting is enabled for the local machine

CPE : Common Platform Enumeration

Type	Description	Count
Os	Microsoft Windows 2000 cpe:2.3:o:microsoft:windows_2000::sp3::::::* cpe:2.3:o:microsoft:windows_2000::sp2::::::* cpe:2.3:o:microsoft:windows_2000::sp1::::::* cpe:2.3:o:microsoft:windows_2000::::::::	4
Os	Microsoft Windows 2000 Terminal Services cpe:2.3:o:microsoft:windows_2000_terminal_services::sp3::::::* cpe:2.3:o:microsoft:windows_2000_terminal_services:::::::: cpe:2.3:o:microsoft:windows_2000_terminal_services::sp2::::::* cpe:2.3:o:microsoft:windows_2000_terminal_services::sp1::::::*	4
Os	Microsoft Windows 98 cpe:2.3:o:microsoft:windows_98::gold::::::*	1
Os	Microsoft Windows 98Se cpe:2.3:o:microsoft:windows_98se::::::::	1
Os	Microsoft Windows Me cpe:2.3:o:microsoft:windows_me::::::::	1
Os	Microsoft Windows Nt cpe:2.3:o:microsoft:windows_nt:4.0:sp6:::server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp5:::workstation::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp3:::server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp4:::terminal_server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp4:enterprise_server:::::* cpe:2.3:o:microsoft:windows_nt:4.0:sp3:::terminal_server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp1:::workstation::x86: cpe:2.3:o:microsoft:windows_nt:4.0::enterprise_server::::: cpe:2.3:o:microsoft:windows_nt:4.0:sp5:::terminal_server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp5:::server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp5:enterprise_server:::::* cpe:2.3:o:microsoft:windows_nt:4.0:sp4:::workstation::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:::terminal_server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp1:::server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp1:enterprise_server:::::* cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:::workstation::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:enterprise_server:::::* cpe:2.3:o:microsoft:windows_nt:4.0::terminal_server::::: cpe:2.3:o:microsoft:windows_nt:4.0::server::::: cpe:2.3:o:microsoft:windows_nt:4.0::workstation::::: cpe:2.3:o:microsoft:windows_nt:4.0:sp2:::server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp1:::terminal_server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp2:enterprise_server:::::* cpe:2.3:o:microsoft:windows_nt:4.0:sp3:::workstation::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp4:::server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp6:enterprise_server:::::* cpe:2.3:o:microsoft:windows_nt:4.0:sp6:::terminal_server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp2:::terminal_server::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp2:::workstation::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp3:enterprise_server:::::* cpe:2.3:o:microsoft:windows_nt:4.0:sp6:::workstation::x86: cpe:2.3:o:microsoft:windows_nt:4.0:sp6a:::server::x86:	32
Os	Microsoft Windows Xp cpe:2.3:o:microsoft:windows_xp::sp1:home::::: cpe:2.3:o:microsoft:windows_xp:::home:::::* cpe:2.3:o:microsoft:windows_xp::gold:professional:::::	3

Open Source Vulnerability Database (OSVDB)

Id	Description
14475	Microsoft Windows Script Engine for Jscript JsArrayFunctionHeapSort Overflow

Nessus® Vulnerability Scanner

Date	Description
2003-03-20	Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms03-008.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:44:49	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	4
CPE ID(s)	46
osvdb(s)	1
Nessus® Exploit(s)	1

	Related
7.5	CVE-2003-0010
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0450s

Facebook rss twitter linkedin mail