Microsoft Baseline Security Analyzer Vulnerability Identification Weakness

Bugtraq ID:	9634
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 10 2004 12:00AM
Updated:	Feb 10 2004 12:00AM
Credit:	The disclosure of this issue has been credited to <[email protected]>.
Vulnerable:	Microsoft Baseline Security Analyzer 1.2
Not Vulnerable:

Microsoft Baseline Security Analyzer Vulnerability Identification Weakness

It has been reported that Microsoft Baseline Security Analyzer (MBSA) may be prone to a weakness that may lead to a false sense of security. It has been reported that under some circumstances MBSA may not properly identify security vulnerabilities in the target operating system.

Microsoft Baseline Security Analyzer version 1.2 is assumed to be affected by this issue, however, it is possible that other versions are affected by this flaw as well.

Microsoft Baseline Security Analyzer Vulnerability Identification Weakness

No exploit is required as this issue does not directly influence the system in a malicious way.

Proof of concept screenshots can be obtained via the following link:
http://www.elusiveworld.com/scanshots.pdf

Microsoft Baseline Security Analyzer Vulnerability Identification Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Baseline Security Analyzer Vulnerability Identification Weakness

References:

• Microsoft Baseline Security Analyzer (Microsoft)
  
• Another Low Blow From Microsoft: MBSA Failure! ()