Microsoft Internet Explorer 'MSXML' Error Files Enumeration Weakness

Bugtraq ID:	59657
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 25 2013 12:00AM
Updated:	Apr 25 2013 12:00AM
Credit:	Soroush Dalili
Vulnerable:	Microsoft Internet Explorer 10.0.9200.16540
Not Vulnerable:

Microsoft Internet Explorer 'MSXML' Error Files Enumeration Weakness

Microsoft Internet Explorer is prone to a file-enumeration weakness.

An attacker can exploit this issue to enumerate the files present in the system's root directory; this may aid in further attacks.

Internet Explorer 10.0.9200.16540 running on Windows 7 Professional is vulnerable; other versions may also be affected.

Microsoft Internet Explorer 'MSXML' Error Files Enumeration Weakness

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Microsoft Internet Explorer 'MSXML' Error Files Enumeration Weakness

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Internet Explorer 'MSXML' Error Files Enumeration Weakness

References:

• Microsoft Internet Explorer Homepage (Microsoft)
  
• Microsoft XMLDOM in IE can divulge information of local drive/network in error m (Soroush Dalili)