Vulnerability Bulletins |
Vulnerabilidad en Microsoft XML Core Services |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio exotico |
System information |
|
| Property | Value |
| Affected manufacturer | Microsoft |
| Affected software | Microsoft XML Core Services |
Description |
|
|
Se ha descubierto una vulnerabilidad en Microsoft XML Core Services. La vulnerabilidad reside en un error desconocido en el control de ActiveX XMLHTTP 4.0. Un atacante remoto podría ejecutar código arbitrario mediante una página Web especialmente diseñada que la víctima debe visualizar con Internet Explorer. |
|
Solution |
|
|
Actualización de software Microsoft Microsoft XML Core Services 4.0 http://www.microsoft.com/downloads/details.aspx?FamilyId=24B7D141-6CDF-4FC4-A91B-6F18FE6921D4 Microsoft XML Core Services 6.0 http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE7F4E9-8228-4098-AF71-49C35684C17E |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2006-5745 |
| BID | 20915 |
Other resources |
|
|
Microsoft Security Advisory (927892) http://www.microsoft.com/technet/security/advisory/927892.mspx Secunia (22687) http://secunia.com/advisories/22687/ Microsoft Security Bulletin MS06-070 http://www.microsoft.com/technet/security/bulletin/ms06-070.mspx Microsoft Security Bulletin MS06-071 http://www.microsoft.com/technet/security/bulletin/ms06-071.mspx |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2006-11-06 |
| 1.1 | CVE añadido | 2006-11-14 |
| 1.2 | Aviso emitido por Microsoft (MS06-071) | 2006-11-16 |