Microsoft Virtual Machine Multiple JDBC Vulnerabilities
BID:5748
Info
Microsoft Virtual Machine Multiple JDBC Vulnerabilities
| Bugtraq ID: | 5748 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 19 2002 12:00AM |
| Updated: | Sep 19 2002 12:00AM |
| Credit: | Reported in Microsoft Security Bulletin MS02-052. |
| Vulnerable: |
Microsoft Virtual Machine 3805 Series Microsoft Virtual Machine 3802 Series Microsoft Virtual Machine 3300 Series Microsoft Virtual Machine 3200 Series Microsoft Virtual Machine 3188 Microsoft Virtual Machine 3100 Series Microsoft Virtual Machine 3000 Series Microsoft Virtual Machine 2000 Series |
| Not Vulnerable: | |
Discussion
Microsoft Virtual Machine Multiple JDBC Vulnerabilities
Microsoft Virtual Machine contains three vulnerabilities that could allow a remote attacker to execute code on the vulnerable system. Successful exploitation could lead to a complete system compromise.
The first vulnerability allows remote execution of DLLs. These would be executed in the context of the currently logged in user.
The second vulnerability involves improper validation in handles provided as input. Supplying malformed data would cause the application hosting the virtual machine to fail.
The third vulnerability allows a set of XML methods to be exposed to all applications rather than a set of trusted applications. This could allow arbitrary code execution on the vulnerable system in the security context of the currently logged in user.
Microsoft Virtual Machine contains three vulnerabilities that could allow a remote attacker to execute code on the vulnerable system. Successful exploitation could lead to a complete system compromise.
The first vulnerability allows remote execution of DLLs. These would be executed in the context of the currently logged in user.
The second vulnerability involves improper validation in handles provided as input. Supplying malformed data would cause the application hosting the virtual machine to fail.
The third vulnerability allows a set of XML methods to be exposed to all applications rather than a set of trusted applications. This could allow arbitrary code execution on the vulnerable system in the security context of the currently logged in user.
Solution / Fix
Microsoft Virtual Machine Multiple JDBC Vulnerabilities
Solution:
Microsoft has released patches through the Windows Update website.
Solution:
Microsoft has released patches through the Windows Update website.
References
Microsoft Virtual Machine Multiple JDBC Vulnerabilities
References:
References:
- Microsoft Security Bulletin MS02-052 (Microsoft)