Description
XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.
Products
- Microsoft Internet Explorer 6.0
- Microsoft Internet Explorer 6.0 -
- Microsoft Internet Explorer 6.0 Service Pack 1
- Microsoft SQL Server 2000
- Microsoft SQL Server 2000
- Microsoft SQL Server 2000 (Initial Release)
- Microsoft SQLServer 2000 Service Pack 1
- Microsoft SQLServer 2000 Service Pack 2
- Microsoft SQLServer 2000 Service Pack 3
- Microsoft SQLServer 2000 Service Pack 3a
- Microsoft SQL Server 2000 Service Pack 4
- Microsoft SQL Server 2000 Service Pack 4 Analysis Services
- Microsoft xml_core_services 2.6
- Microsoft xml_core_services 3.0
- Microsoft xml_core_services 4.0
- Microsoft Windows XP Home Edition
- Microsoft Windows XP Gold Professional
- Microsoft Windows XP (gold) Home Edition
- Microsoft Windows XP Professional Gold
- Microsoft Windows XP Service Pack 1 Home Edition
- Microsoft Windows XP Service Pack 2 Home Edition
- Microsoft Windows XP Service Pack 3 Home Edition
Questions to Ask Vendors
- Can you confirm whether your systems are affected by CVE-2002-0057, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2002-0057 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions
- Check out the advisory links provided below.
References