Title: Microsoft Internet Explorer XMLHTTP File Disclosure Vulnerability
Severity: MODERATE
Description:
An issue exists in handling of HTTP redirects in the Microsoft XMLHTTP ActiveX component.
When a server responds to a XMLHTTP request with a redirect, the XMLHTTP method will access the content at the location of the redirect without considering the URL protocol. If the redirect is to a file on the user's filesystem, the contents of the file will become available to the script code that invoked the ActiveX object.
The vulnerability is present when a request is made to a server via the XMLHTTP methods 'XMLHTTP.Open()' and 'XMLHTTP.Send()', and the response is a redirect such as this:
The URL has moved <a href="file:///c:/filename.txt">here</a>
XMLHTTP will automatically follow the redirect, and read the contents of the file in. The file contents are then accessible by the rest of the script code as the request response property, and may be transmitted to another website.
This could lead to a disclosure of sensitive information to remote attackers.
Affected Products:
- Microsoft Internet Explorer 6.0
- Microsoft SQL Server 2000
- Microsoft SQL Server 2000 SP1
- Microsoft SQL Server 2000 SP2
- Microsoft Windows Server 2003 Datacenter Edition
- Microsoft Windows Server 2003 Datacenter Edition Itanium
- Microsoft Windows Server 2003 Enterprise Edition
- Microsoft Windows Server 2003 Enterprise Edition Itanium
- Microsoft Windows Server 2003 Standard Edition
- Microsoft Windows Server 2003 Web Edition
- Microsoft Windows XP Home
- Microsoft Windows XP Professional
- Microsoft XML Core Services 2.6.0
- Microsoft XML Core Services 3.0
- Microsoft XML Core Services 4.0.0
References:
- Microsoft: Microsoft Security Bulletin MS02-008
- Microsoft: Microsoft Security Bulletin MS02-047
- Microsoft: Microsoft Windows Update
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
