Vulnerability Bulletins |
Salto de restricciones de dominio de Microsoft Internet Explorer en Microsoft Windows Mail y Microsoft Outlook Express |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Confidencialidad |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | Microsoft |
| Affected software |
Microsoft Windows Mail Microsoft Outlook Express 5.5 SP2 Microsoft Outlook Express 6 Microsoft Outlook Express 6 SP1 |
Description |
|
|
Se ha descubierto una vulnerabilidad en Microsoft Windows Mail y Microsoft Outlook Express. La vulnerabilidad reside en un error en la implementación del protocolo MHTML. Un atacante remoto podría saltar las restricciones de dominio de Internet Explorer mediante cabeceras HTTP especialmente diseñadas. El boletín MS08-048 sustituye al MS07-056. |
|
Solution |
|
|
Actualización de software Microsoft (MS08-048) Windows 2000 SP4 / Outlook Express 5.5 SP2 / patch OE5.5sp2-KB951066-Windows2000-x86-ENU Windows 2000 SP4 / Outlook Express 6 SP1 / patch OE6.0sp1-KB951066-Windows2000-x86-ENU Windows XP SP2/SP3 / Outlook Express 6 / patch WindowsXP-KB951066-x86-ENU Windows XP Professional x64 Edition (opcionalmente con SP2) / Outlook Express 6 / patch WindowsServer2003.WindowsXP-KB951066-x64-ENU Windows Server 2003 SP1/SP2 / Outlook Express 6 / patch WindowsServer2003-KB951066-x86-ENU Windows Server 2003 x64 Edition (opcionalmente con SP2) / Outlook Express 6 / patch WindowsServer2003.WindowsXP-KB951066-x64-ENU Windows Server 2003 con SP1/SP2 para Itanium-based Systems / Outlook Express 6 / patch WindowsServer2003-KB951066-ia64-ENU Windows Vista (opcionalmente con SP1) / Windows Mail / patch WindowsServer2003-KB951066-ia64-ENU Windows Vista x64 Edition (opcionalmente con SP1) / Windows Mail / patch Windows6.0-KB951066-x64 Windows Server 2008 para 32-bit Systems / Windows Mail / patch Windows6.0-KB951066-x86 Windows Server 2008 para x64-based Systems / Windows Mail / patch Windows6.0-KB951066-x64 Windows Server 2008 para Itanium-based Systems / Windows Mail / patch Windows6.0-KB951066-ia64 |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2008-1448 |
| BID | 30585 |
Other resources |
|
|
Microsoft Security Bulletin (MS08-048) http://www.microsoft.com/technet/security/Bulletin/MS08-048.mspx |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2008-08-18 |