5.1 - MS05-032

Executive Summary

Informations
Name	MS05-032	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Cvss Base Score	5.1	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	High
Cvss Expoit Score	4.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability in Microsoft Agent Could Allow Spoofing (890046)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:1194

Oval ID:	oval:org.mitre.oval:def:1194
Title:	Microsoft Agent Security Prompt Spoofing Vulnerability (Windows XP)
Description:	Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1214	Version:	9
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Agent
Definition Synopsis:
Software section Windows XP is installed AND a vulnerable version of agentdpv exists a vulnerable version of agentdpv exists 32-bit version of Windows or 64-bit (itanium architecture) version of Windows is installed 32-Bit version of Windows is installed AND a version of Windows for the ia64 architecture is installed AND NOT Win2K/XP/2003 service pack 2 (or later) is installed AND the version of agentdpv.dll is less than 2.0.0.3423 OR a vulnerable version of agentdpv exists 32-Bit version of Windows is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of agentdpv.dll is less than 2.0.0.3423 OR a vulnerable version of agentdpv exists for Windows Gold 64-bit (x64) 64-Bit (x64 architecture) version of Windows is installed AND NOT Win2K/XP/2003 is patched AND the version of agentdpv.dll is less than 5.2.3790.1241 AND NOT the patch kb890046 is installed AND Configuration section ActiveX controls and active scripting are enabled current user settings are being used and ActiveX controls and active scripting are enabled NOT use machine settings rather than individual user settings AND ActiveX controls are enabled for the current user AND active scripting is enabled for the current user OR local machine settings are being used and ActiveX controls and active scripting are enabled use machine settings rather than individual user settings AND ActiveX controls are enabled for the local machine AND active scripting is enabled for the local machine

Definition Id: oval:org.mitre.oval:def:682

Oval ID:	oval:org.mitre.oval:def:682
Title:	Microsoft Agent Security Prompt Spoofing Vulnerability (Windows 2000)
Description:	Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1214	Version:	7
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Agent
Definition Synopsis:
Software section Windows 2000 (sp4 or earlier) is installed Windows 2000 is installed AND NOT Win2K/XP/2003 service pack 5 (or later) is installed AND the version of agentdpv.dll is less than 2.0.0.3423 AND NOT the patch kb890046 is installed AND Configuration section ActiveX controls and active scripting are enabled current user settings are being used and ActiveX controls and active scripting are enabled NOT use machine settings rather than individual user settings AND ActiveX controls are enabled for the current user AND active scripting is enabled for the current user OR local machine settings are being used and ActiveX controls and active scripting are enabled use machine settings rather than individual user settings AND ActiveX controls are enabled for the local machine AND active scripting is enabled for the local machine

Definition Id: oval:org.mitre.oval:def:906

Oval ID:	oval:org.mitre.oval:def:906
Title:	Microsoft Agent Security Prompt Spoofing Vulnerability (Server 2003)
Description:	Microsoft Agent allows remote attackers to spoof trusted Internet content and execute arbitrary code by disguising security prompts on a malicious Web page.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-1214	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Agent
Definition Synopsis:
Software section Windows Server 2003 is installed AND a vulnerable version of agentdpv exists a vulnerable version of agentdpv exists 32-bit version of Windows or 64-bit (itanium architecture) version of Windows is installed 32-Bit version of Windows is installed AND a version of Windows for the ia64 architecture is installed AND NOT Win2K/XP/2003 is patched AND the version of agentdpv.dll is less than 2.0.0.3423 OR a vulnerable version of agentdpv exists 32-bit version of Windows or 64-bit (itanium architecture) version of Windows is installed 32-Bit version of Windows is installed AND a version of Windows for the ia64 architecture is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of agentdpv.dll is less than 5.2.3790.1241 OR a vulnerable version of agentdpv exists for Windows Gold 64-bit (x64) 64-Bit (x64 architecture) version of Windows is installed AND NOT Win2K/XP/2003 is patched AND the version of agentdpv.dll is less than 5.2.3790.1241 AND NOT the patch kb890046 is installed AND Configuration section ActiveX controls and active scripting are enabled current user settings are being used and ActiveX controls and active scripting are enabled NOT use machine settings rather than individual user settings AND ActiveX controls are enabled for the current user AND active scripting is enabled for the current user OR local machine settings are being used and ActiveX controls and active scripting are enabled use machine settings rather than individual user settings AND ActiveX controls are enabled for the local machine AND active scripting is enabled for the local machine

CPE : Common Platform Enumeration

Type	Description	Count
Os	Microsoft Windows 2000 cpe:2.3:o:microsoft:windows_2000:::::::: cpe:2.3:o:microsoft:windows_2000::sp4::::::* cpe:2.3:o:microsoft:windows_2000::sp3::::::* cpe:2.3:o:microsoft:windows_2000::sp2::::::* cpe:2.3:o:microsoft:windows_2000::sp1::::::* cpe:2.3:o:microsoft:windows_2000::sp4::fr::::	6
Os	Microsoft Windows 2000 Terminal Services cpe:2.3:o:microsoft:windows_2000_terminal_services::sp3::::::* cpe:2.3:o:microsoft:windows_2000_terminal_services:::::::: cpe:2.3:o:microsoft:windows_2000_terminal_services::sp2::::::* cpe:2.3:o:microsoft:windows_2000_terminal_services::sp1::::::*	4
Os	Microsoft Windows 2003 Server cpe:2.3:o:microsoft:windows_2003_server:64-bit:::::::* cpe:2.3:o:microsoft:windows_2003_server:web:sp1:::::: cpe:2.3:o:microsoft:windows_2003_server:web:sp1_beta_1:::::: cpe:2.3:o:microsoft:windows_2003_server:web:::::::* cpe:2.3:o:microsoft:windows_2003_server:standard_64-bit:::::::* cpe:2.3:o:microsoft:windows_2003_server:standard:sp1_beta_1:::::: cpe:2.3:o:microsoft:windows_2003_server:standard::64-bit::::: cpe:2.3:o:microsoft:windows_2003_server:standard:sp1:::::: cpe:2.3:o:microsoft:windows_2003_server:r2::64-bit::::: cpe:2.3:o:microsoft:windows_2003_server:r2:sp1_beta_1:::::: cpe:2.3:o:microsoft:windows_2003_server:r2:::::::* cpe:2.3:o:microsoft:windows_2003_server:r2:sp1:::::: cpe:2.3:o:microsoft:windows_2003_server:r2::datacenter_64-bit::::: cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:sp1:::::: cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:::::::* cpe:2.3:o:microsoft:windows_2003_server:enterprise_64-bit:sp1_beta_1:::::: cpe:2.3:o:microsoft:windows_2003_server:enterprise:sp1:::::: cpe:2.3:o:microsoft:windows_2003_server:enterprise::64-bit::::: cpe:2.3:o:microsoft:windows_2003_server:enterprise:sp1_beta_1:::::: cpe:2.3:o:microsoft:windows_2003_server:datacenter_64-bit:sp1:::::: cpe:2.3:o:microsoft:windows_2003_server:datacenter_64-bit:sp1_beta_1::::::	21
Os	Microsoft Windows 98 cpe:2.3:o:microsoft:windows_98::gold::::::*	1
Os	Microsoft Windows 98Se cpe:2.3:o:microsoft:windows_98se::::::::	1
Os	Microsoft Windows Me cpe:2.3:o:microsoft:windows_me:::::::: cpe:2.3:o:microsoft:windows_me:::second_edition:::::*	2
Os	Microsoft Windows Xp cpe:2.3:o:microsoft:windows_xp::sp2:tablet_pc::::: cpe:2.3:o:microsoft:windows_xp::gold:professional::::: cpe:2.3:o:microsoft:windows_xp::sp1:media_center::::: cpe:2.3:o:microsoft:windows_xp::sp1:embedded::::: cpe:2.3:o:microsoft:windows_xp::sp1:tablet_pc::::: cpe:2.3:o:microsoft:windows_xp:::64-bit:::::* cpe:2.3:o:microsoft:windows_xp:::home:::::* cpe:2.3:o:microsoft:windows_xp::sp1:home::::: cpe:2.3:o:microsoft:windows_xp:::embedded:::::* cpe:2.3:o:microsoft:windows_xp::gold::::::* cpe:2.3:o:microsoft:windows_xp::sp2:media_center::::: cpe:2.3:o:microsoft:windows_xp::sp2:home::::: cpe:2.3:o:microsoft:windows_xp::sp1:64-bit::::: cpe:2.3:o:microsoft:windows_xp:::media_center:::::*	14

Open Source Vulnerability Database (OSVDB)

Id	Description
17310	Microsoft Agent Trusted Internet Content Spoofing (fireclicking)

Snort® IPS/IDS

Date	Description
2014-01-10	Microsoft Agent v1.5 ActiveX function call access RuleID : 8856 - Revision : 12 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Agent v1.5 ActiveX clsid unicode access RuleID : 8855 - Revision : 7 - Type : WEB-ACTIVEX
2014-01-10	Microsoft Windows Agent v1.5 ActiveX clsid access RuleID : 4172 - Revision : 15 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Agent v1.5 ActiveX function call unicode access RuleID : 10465 - Revision : 7 - Type : WEB-ACTIVEX

Nessus® Vulnerability Scanner

Date	Description
2005-06-14	Name : It is possible to spoof the content of a website. File : smb_nt_ms05-032.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:45:12	Multiple Updates
2014-01-19 21:29:55	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	3
CPE ID(s)	49
osvdb(s)	1
Snort® Rule(s)	4
Nessus® Exploit(s)	1

	Related
5.1	CVE-2005-1214
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0429s

Facebook rss twitter linkedin mail