Executive Summary
| Summary | |
|---|---|
| Title | Microsoft Updates for Multiple Vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | TA08-316A | First vendor Publication | 2008-11-11 |
| Vendor | US-CERT | Last vendor Modification | 2008-11-11 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Microsoft has released updates that address vulnerabilities in Microsoft Windows, Microsoft Office, and Microsoft XML Core Services. I. Description As part of the Microsoft Security Bulletin Summary for November 2008, Microsoft released updates to address vulnerabilities that affect Microsoft Windows, Microsoft Office, and Microsoft XML Core Services. The most severe vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code. II. Impact A remote, unauthenticated attacker could execute arbitrary code or cause a vulnerable application to crash. III. Solution Apply updates from Microsoft Microsoft has provided updates for these vulnerabilities in the Microsoft Security Bulletin Summary for November 2008. The security bulletin describes any known issues related to the updates. Administrators are encouraged to note these issues and test for any potentially adverse effects. |
Original Source
| Url : http://www.us-cert.gov/cas/techalerts/TA08-316A.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-200 | Information Exposure |
| 25 % | CWE-362 | Race Condition |
| 25 % | CWE-287 | Improper Authentication |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:5793 | |||
| Oval ID: | oval:org.mitre.oval:def:5793 | ||
| Title: | MSXML Memory Corruption Vulnerability | ||
| Description: | Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via many nested tags in an XML document in an IFRAME, when synchronous document rendering is frequently disrupted with asynchronous events, as demonstrated using a JavaScript timer, which can trigger NULL pointer dereferences or memory corruption, aka "MSXML Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-0099 | Version: | 1 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:5847 | |||
| Oval ID: | oval:org.mitre.oval:def:5847 | ||
| Title: | MSXML Header Request Vulnerability | ||
| Description: | Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2008-4033 | Version: | 1 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | Microsoft Office 2003 Microsoft Office 2008 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:5999 | |||
| Oval ID: | oval:org.mitre.oval:def:5999 | ||
| Title: | MSXML DTD Cross-Domain Scripting Vulnerability | ||
| Description: | Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive information from another domain via a crafted XML document, related to improper error checks for external DTDs, aka "MSXML DTD Cross-Domain Scripting Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2008-4029 | Version: | 1 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:6012 | |||
| Oval ID: | oval:org.mitre.oval:def:6012 | ||
| Title: | SMB Credential Reflection Vulnerability | ||
| Description: | Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability." NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2008-4037 | Version: | 6 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
SAINT Exploits
| Description | Link |
|---|---|
| Windows SMB credential reflection vulnerability | More info here |
ExploitDB Exploits
| id | Description |
|---|---|
| 2008-11-23 | Microsoft XML Core Services DTD - Cross-Domain Scripting PoC (MS08-069) |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-11-12 | Name : SMB Could Allow Remote Code Execution Vulnerability (957097) File : nvt/secpod_ms08-068_900057.nasl |
| 2008-11-12 | Name : Microsoft XML Core Services Remote Code Execution Vulnerability (955218) File : nvt/secpod_ms08-069_900058.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 50279 | Microsoft XML Core Services HTTP Request Header Field Cross-domain Session St... |
| 49926 | Microsoft XML Core Services DTD Crafted XML Document Handling Cross-Domain Sc... |
| 49736 | Microsoft Windows SMB NTLM Authentication Credential Replay Remote Code Execu... Windows contains a flaw that may allow a malicious remote user to execute arbitrary code. The issue is triggered by a flaw that allows an attacker to replay the NTLM credentials of a client user. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity. |
| 32627 | Microsoft IE msxml3 Module Nested Tag Race Condition DoS |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2008-11-13 | IAVM : 2008-A-0084 - Multiple Vulnerabilities in Microsoft XML Core Services Severity : Category II - VMSKEY : V0017877 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2019-09-17 | Microsoft XML core services cross-domain information disclosure attempt RuleID : 51038 - Revision : 1 - Type : BROWSER-IE |
| 2015-04-14 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 33829 - Revision : 2 - Type : OS-WINDOWS |
| 2015-04-14 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 33828 - Revision : 2 - Type : OS-WINDOWS |
| 2015-04-14 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 33827 - Revision : 2 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft XML core services cross-domain information disclosure attempt RuleID : 19818 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft XML Core Services MIME Viewer memory corruption attempt RuleID : 17730 - Revision : 9 - Type : OS-WINDOWS |
| 2014-01-10 | possible SMB replay attempt - overlapping encryption keys detected RuleID : 17723 - Revision : 12 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft XML Core Services cross-site information disclosure attempt RuleID : 17572 - Revision : 11 - Type : OS-WINDOWS |
| 2014-01-10 | Telnet-based NTLM replay attack attempt RuleID : 15847 - Revision : 14 - Type : OS-WINDOWS |
| 2014-01-10 | SMB replay attempt via NTLMSSP - overlapping encryption keys detected RuleID : 15453 - Revision : 16 - Type : OS-WINDOWS |
| 2014-01-10 | Web-based NTLM replay attack attempt RuleID : 15124 - Revision : 17 - Type : OS-WINDOWS |
| 2014-01-10 | Microsoft Internet Explorer MSXML DLL memory corruption attempt RuleID : 15012 - Revision : 9 - Type : BROWSER-IE |
| 2015-05-28 | Microsoft XML core services cross-domain information disclosure attempt RuleID : 15011 - Revision : 7 - Type : WEB-CLIENT |
| 2014-01-10 | possible SMB replay attempt - overlapping encryption keys detected RuleID : 15009 - Revision : 22 - Type : OS-WINDOWS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-11-12 | Name : It is possible to execute code on the remote host. File : smb_nt_ms08-068.nasl - Type : ACT_GATHER_INFO |
| 2008-11-12 | Name : Arbitrary code can be executed on the remote host through the web or email cl... File : smb_nt_ms08-069.nasl - Type : ACT_GATHER_INFO |
