PUBLISHED DATE: December 23, 2002CVE-2002-1258:
Two vulnerabilities in Microsoft...

Description

Two vulnerabilities in Microsoft Virtual Machine (VM) up to and including build 5.0.3805, as used in Internet Explorer and other applications, allow remote attackers to read files via a Java applet with a spoofed location in the CODEBASE parameter in the APPLET tag, possibly due to a parsing error.

Products

• Microsoft Windows 2000
• Microsoft Windows 2000 Service Pack 1
• Microsoft Windows 2000 Service Pack 2
• Microsoft Windows 2000 Service Pack 3
• Microsoft Windows 2000
• Microsoft Windows 2000 Japanese Server Edition
• Microsoft Windows 2000 Advanced Server Edition
• Microsoft Windows 2000 Datacenter Server Edition
• Microsoft Windows 2000 Professional Edition
• Microsoft Windows 2000 Server Edition
• Microsoft Windows 2000 Beta 3
• Microsoft windows 2000_gold
• Microsoft Windows 2000 Addvanced Server (Initial Release)
• Microsoft Windows 2000 Datacenter Server (Initial Release)
• Microsoft Windows 2000 Professional (Initial release)
• Microsoft Windows 2000 Server (Inital release)
• Microsoft windows 2000_rc1
• Microsoft windows 2000_rc2
• Microsoft windows 2000_sp1
• Microsoft Windows 2000 Service Pack 1 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 1 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 1 Professional Edition
• Microsoft Windows 2000 Service Pack 1 Server Edition
• Microsoft Windows 2000 Advanced Server SP1
• Microsoft Windows 2000 Datacenter Server SP1
• Microsoft Windows 2000 Professional SP1
• Microsoft Windows 2000 Server SP1
• Microsoft windows 2000_sp2
• Microsoft Windows 2000 Service Pack 2 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 2 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 2 Professional Edition
• Microsoft Windows 2000 Service Pack 2 Server Edition
• Microsoft Windows 2000 Advanced Server SP2
• Microsoft Windows 2000 Datacenter Server SP2
• Microsoft Windows 2000 Professional SP2
• Microsoft Windows 2000 Server SP2
• Microsoft windows 2000_sp3
• Microsoft Windows 2000 Service Pack 3 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 3 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 3 Professional Edition
• Microsoft Windows 2000 Service Pack 3 Server Edition
• Microsoft Windows 2000 Advanced Server SP3
• Microsoft Windows 2000 Datacenter Server SP3
• Microsoft Windows 2000 Professional SP3
• Microsoft Windows 2000 Server SP3
• Microsoft Windows 2000 Service Pack 4
• Microsoft Windows 2000 Service Pack 4 Advanced Server Edition
• Microsoft Windows 2000 Service Pack 4 Datacenter Server Edition
• Microsoft Windows 2000 Service Pack 4 Professional Edition
• Microsoft Windows 2000 Service Pack 4 Server Edition
• Microsoft Windows 2000 Service Pack 4 French
• Microsoft Windows 2000 Advanced Server SP4
• Microsoft Windows 2000 Datacenter Server SP4
• Microsoft Windows 2000 Professional SP4
• Microsoft Windows 2000 Server SP4
• Microsoft windows 2000_beta3
• Microsoft Windows 2000 Terminal Services
• Microsoft Windows 2000 Terminal Services Service Pack 1
• Microsoft Windows 2000 Terminal Services Service Pack 2
• Microsoft Windows 2000 Terminal Services Service Pack 3
• Microsoft Windows 2000 Terminal Services
• Microsoft Windows 2000 Terminal Services Service Pack 1
• Microsoft Windows 2000 Terminal Services Service Pack 2
• Microsoft Windows 2000 Terminal Services Service Pack 3
• Microsoft Windows 95
• Microsoft Windows 95 SR2
• Microsoft Windows 95
• Microsoft windows 95_gold
• Microsoft windows 95_osr2.1
• Microsoft windows 95_osr2.5
• Microsoft windows 95_osr2
• Microsoft windows 95_sp1
• Microsoft Windows 95 SR2
• Microsoft Windows 98 Gold
• Microsoft windows 98_gold
• Microsoft Windows 98SE
• Microsoft windows 98_se
• Microsoft Windows ME
• Microsoft Windows ME
• Microsoft windows me_gold
• Microsoft Windows Millenium Edition SCD
• Microsoft Windows NT 4.0 Service Pack 1 Enterprise Server
• Microsoft Windows 4.0 sp1 server
• Microsoft Windows NT Terminal Server 4.0 SP1
• Microsoft Windows 4.0 sp1 workstation
• Microsoft Windows NT 4.0 Service Pack 2 Enterprise Server
• Microsoft Windows 4.0 sp2 server
• Microsoft Windows NT Terminal Server 4.0 SP2
• Microsoft Windows 4.0 sp2 workstation
• Microsoft Windows NT 4.0 Service Pack 3 Enterprise Server
• Microsoft Windows 4.0 sp3 server
• Microsoft Windows NT Terminal Server 4.0 SP3
• Microsoft Windows 4.0 sp3 workstation
• Microsoft Windows NT 4.0 Service Pack 4 Enterprise Server
• Microsoft Windows 4.0 sp4 server
• Microsoft Windows NT Terminal Server 4.0 SP4
• Microsoft Windows 4.0 sp4 workstation
• Microsoft Windows NT 4.0 Service Pack 5 Enterprise Server
• Microsoft Windows 4.0 sp5 server
• Microsoft Windows NT Terminal Server 4.0 SP5
• Microsoft Windows 4.0 sp5 workstation
• Microsoft Windows NT 4.0 Service Pack 6 Enterprise Server
• Microsoft Windows 4.0 sp6 server
• Microsoft Windows NT Terminal Server 4.0 SP6
• Microsoft Windows 4.0 sp6 workstation
• Microsoft Windows NT 4.0 Service Pack 6a Enterprise Server
• Microsoft Windows 4.0 sp6a server
• Microsoft Windows NT Terminal Server 4.0 SP6a
• Microsoft Windows 4.0 sp6a workstation
• Microsoft Windows XP Gold Professional
• Microsoft Windows XP SP1 Home
• Microsoft Windows XP Professional Gold
• Microsoft Windows XP Service Pack 1 Home Edition

Questions to Ask Vendors

1. Can you confirm whether your systems are affected by CVE-2002-1258, and if so, what steps are you currently taking to mitigate this vulnerability?
2. What is your estimated timeline for fully resolving CVE-2002-1258 in your products or services, and how will you communicate updates on this issue to us as your customer?

Recommended Actions

• Check out the advisory links provided below.

References

• https://nvd.nist.gov/vuln/detail/CVE-2002-1258