RETIRED:Microsoft Internet Explorer Cross Site Scripting Filter Information Disclosure Vulnerability

Bugtraq ID:	37883
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 21 2010 12:00AM
Updated:	Jan 22 2010 08:51PM
Credit:	David Lindsay 'thornmaker' and, Eduardo A. Vela Nava 'sirdarckcat'
Vulnerable:	Microsoft Internet Explorer 8 + Microsoft Windows 7 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium 0 + Microsoft Windows 7 Home Premium 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2008 R2 SP1 + Microsoft Windows Server 2008 R2 SP1 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Server 2008 R2 x64 SP1 + Microsoft Windows Server 2008 R2 x64 SP1 + Microsoft Windows Server 2008 R2 x64 0 + Microsoft Windows Server 2008 R2 x64 0 + Microsoft Windows Server 2008 Standard Edition X64 + Microsoft Windows Server 2008 Standard Edition X64 + Microsoft Windows Server 2008 Standard Edition SP2 + Microsoft Windows Server 2008 Standard Edition SP2 + Microsoft Windows Server 2008 Standard Edition 0 + Microsoft Windows Server 2008 Standard Edition 0 + Microsoft Windows Server 2008 Standard Edition - Sp2 Web + Microsoft Windows Server 2008 Standard Edition - Sp2 Web + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista SP1 + Microsoft Windows Vista Home Premium SP2 + Microsoft Windows Vista Home Premium SP2 + Microsoft Windows Vista Home Premium SP1 + Microsoft Windows Vista Home Premium SP1 + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Basic SP2 + Microsoft Windows Vista Home Basic SP2 + Microsoft Windows Vista Home Basic SP1 + Microsoft Windows Vista Home Basic SP1 + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Enterprise SP2 + Microsoft Windows Vista Enterprise SP2 + Microsoft Windows Vista Enterprise SP1 + Microsoft Windows Vista Enterprise SP1 + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Business SP2 + Microsoft Windows Vista Business SP2 + Microsoft Windows Vista Business SP1 + Microsoft Windows Vista Business SP1 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista Business 64-bit edition SP2 + Microsoft Windows Vista Business 64-bit edition SP2 + Microsoft Windows Vista Business 64-bit edition SP1 + Microsoft Windows Vista Business 64-bit edition SP1 + Microsoft Windows Vista Business 64-bit edition 0 + Microsoft Windows Vista Business 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition Sp2 X64 + Microsoft Windows Vista Home Basic 64-bit edition Sp2 X64 + Microsoft Windows Vista Home Basic 64-bit edition SP2 + Microsoft Windows Vista Home Basic 64-bit edition SP2 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows XP 0 + Microsoft Windows XP 0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP2 + Microsoft Windows XP Embedded SP2 + Microsoft Windows XP Embedded SP1 + Microsoft Windows XP Embedded SP1 + Microsoft Windows XP Embedded + Microsoft Windows XP Embedded + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP1 + Microsoft Windows XP Media Center Edition SP1 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition + Microsoft Windows XP Professional x64 Edition
Not Vulnerable:

RETIRED:Microsoft Internet Explorer Cross Site Scripting Filter Information Disclosure Vulnerability

Microsoft Internet Explorer is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information that may lead to further attacks.

This BID is being retired as a duplicate of BID 37135 (Microsoft Internet Explorer 8 Cross-Site Scripting Filter Cross-Site Scripting Vulnerability).

RETIRED:Microsoft Internet Explorer Cross Site Scripting Filter Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft Internet Explorer 8

• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=7d480c87-2ca9 -4505-a59d-a6d73d001fa5


• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 x64 Edition (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=3e2e740b-8417 -4758-8468-15221249ec71


• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows XP (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=7c2948fb-f486 -4801-bc21-bbf40d5a78c2


• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows XP x64 Edition (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=41b83fad-948b -4a9c-80ed-9c5a60bd35b4


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows 7 (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=278443c1-15dc -436b-893b-ffea6d29d16d


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows 7 x64 Edition (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=a584cd0f-2e05 -4e36-8858-0ffead637162


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=f5ce8582-af63 -4870-bee3-0abeeefa1458


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 R2 for Itanium-based Syste
  http://www.microsoft.com/downloads/details.aspx?familyid=9d137bab-8312 -4240-af74-c65ba652fde0


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 R2 x64 Edition (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=d3386793-a594 -4bc5-8308-28b561d43087


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 x64 Edition (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=be11981c-d286 -4e3c-94bf-d4e67a975d5a


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Vista (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=5e2cbd7d-f64f -49e5-a159-1965ebfe2a92


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Vista x64 Edition (KB978207)
  http://www.microsoft.com/downloads/details.aspx?familyid=b7a7e8e7-f4c5 -459d-ab6c-05a192e1e3f9

RETIRED:Microsoft Internet Explorer Cross Site Scripting Filter Information Disclosure Vulnerability

References:

• Internet Explorer Homepage (Microsoft)
  
• Microsoft Security Bulletin MS10-002 (Microsoft)