Test ID:	10866
Category:	Windows : Microsoft Bulletins
Title:	XML Core Services patch (Q318203)
Summary:	XMLHTTP Control Can Allow Access to Local Files.
Description:	Summary: XMLHTTP Control Can Allow Access to Local Files. Vulnerability Insight: A flaw exists in how the XMLHTTP control applies IE security zone settings to a redirected data stream returned in response to a request for data from a web site. A vulnerability results because an attacker could seek to exploit this flaw and specify a data source that is on the user's local system. The attacker could then use this to return information from the local system to the attacker's web site. Vulnerability Impact: Attacker can read files on client system. Affected Software/OS: - Microsoft XML Core Services versions 2.6, 3.0, and 4.0. An affected version of XML Core Services is also shipped as part of the following products: - Microsoft Windows XP - Microsoft Internet Explorer 6.0 - Microsoft SQL Server 2000 (note: versions earlier than 2.6 are not affected files affected include msxml[2-4].dll and are found in the system32 directory. This might be false positive if you have earlier version) Solution: The vendor has released updates. Please see the references for more information. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2002-0057 BugTraq ID: 3699 http://www.securityfocus.com/bid/3699 Bugtraq: 20011214 MSIE6 can read local files (Google Search) http://archives.neohapsis.com/archives/bugtraq/2001-12/0152.html Bugtraq: 20020212 Update on the MS02-005 patch, holes still remain (Google Search) http://marc.info/?l=bugtraq&m=101366383408821&w=2 Microsoft Security Bulletin: MS02-008 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-008 http://www.osvdb.org/3032 XForce ISS Database: ie-xmlhttp-redirect(7712) https://exchange.xforce.ibmcloud.com/vulnerabilities/7712
Copyright	Copyright (C) 2002 Michael Scheidell

This is only one of 144924 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.