Vulnerability Bulletins |
Elevación de privilegios en Microsoft Internet Information Services |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Compromiso Root |
| Dificulty | Experto |
| Required attacker level | Acceso remoto con cuenta |
System information |
|
| Property | Value |
| Affected manufacturer | Microsoft |
| Affected software |
Microsoft Internet Information Services 5.0 - 7.0 HP Storage Management Appliance v2.1 |
Description |
|
|
Se ha descubierto una vulnerabilidad en Microsoft Internet Information Services (IIS) 5.0 hasta la 7.0. La vulnerabilidad reside en un error en las notificaciones de cambio de ficheros en los directorios "TPRoot", "NNTPFile\Root", o "WWWRoot". Un atacante local podría elevar sus privilegios y ejecutar código arbitrario en el contexto de "Local System" mediante métodos no especificados. |
|
Solution |
|
|
Actualización de software Microsoft (MS08-005) Internet Information Services Windows Windows 2000 / patch Windows2000-KB942831-x86-enu Windows XP (32-bit) / patch WindowsXP-KB942831-x86-enu Windows XP (x64) / WindowsServer2003.WindowsXP-KB942831-x64-enu Windows Server 2003 (32-bit) / patch WindowsServer2003-KB942831-x86-enu Windows Server 2003 (Itanium) / patch WindowsServer2003-KB942831-ia64-enu Windows Server 2003 (x64) / patch WindowsServer2003.WindowsXP-KB942831-x64-enu Windows Vista (32-bit) / patch Windows6.0-KB942831-x86 Windows Vista (x64) / Windows6.0-KB942831-x64 Hewlett-Packard Storage Management Appliance v2.1 Instale el parche de Microsoft correspondiente a su sistema operativo. |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2008-0074 |
| BID | 27101 |
Other resources |
|
|
Microsoft Security Bulletin (MS08-005) http://www.microsoft.com/technet/security/bulletin/ms08-005.mspx HP SECURITY BULLETIN (HPSBST02314) https://www12.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01372284-1 |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2008-02-13 |
| 1.1 | Aviso emitido por HP (HPSBST02314) | 2008-02-21 |