Microsoft Taskpads Scripting Vulnerability

Bugtraq ID:	498
Class:	Design Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 22 1999 12:00AM
Updated:	Feb 22 1999 12:00AM
Credit:	This vulnerability was brought to Microsoft's attention on Dec 30, 1998 by Adrian O'Neill <[email protected]>.
Vulnerable:	Microsoft BackOffice Resource Kit SE + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Taskpads Scripting Vulnerability

The windows 98 and BackOffice REsouce Kits came with a new feature called Taskpads, which allows Windows administrative tasks to be run through a web page. Due to unsafe components in the scripting package, a malicious web site operator could run executables on the local machine.

Microsoft Taskpads Scripting Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Microsoft Taskpads Scripting Vulnerability

Solution:
Microsoft has made patches available for free download.
For the Windows98 Resource Kit:
ftp://ftp.microsoft.com/reskit/win98/taskpads/
For the BackOffice Resource Kit:
ftp://ftp.microsoft.com/reskit/nt4/x86/taskpads/
ftp://ftp.microsoft.com/reskit/nt4/alpha/taskpads/

Microsoft Taskpads Scripting Vulnerability

References:

• Taskpads Let Web Sites Invoke Executables on a User's Computer (Microsoft)