Update Protection against Indexing Service Cross-Site Scripting Vulnerability (MS06-053)
| Check Point Reference: | CPAI-2006-110 | |
| Date Published: | ||
| Severity: | ||
| Last Updated: | ||
| Source: | Microsoft Security Bulletin MS06-053 | |
| Industry Reference(s): | CVE-2006-0032 FrSIRT/ADV-2006-3564 |
|
| Protection Provided by: |
VPN-1
|
|
| Who is Vulnerable? Microsoft Windows 2000 SP4 Microsoft Windows XP SP1 Microsoft Windows XP SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows Server 2003 Microsoft Windows Server 2003 SP1 Microsoft Windows Server 2003 (Itanium) Microsoft Windows Server 2003 SP1 (Itanium) Microsoft Windows Server 2003 x64 Edition | ||
| Vulnerability Description A cross-site scripting (XSS) vulnerability exists in Microsoft Windows Indexing Service. Indexing Service is a feature that supports rapid searching of file contents and properties by extracting information from files and storing it in indexes organized for fast searching. A remote attacker can exploit this vulnerability to execute arbitrary commands on an affected system. Note: This vulnerability puts at risk only users of systems that have IIS and Indexing Service installed and that enabled the Indexing Service to be accessible from IIS via a web-based interface. |
||
|
Update/Patch Available Apply patches: Microsoft Security Bulletin MS06-053 |
|
|
Vulnerability Details This cross-site scripting vulnerability is due to an input validation error in Microsoft Windows Indexing Service. A remote attacker can exploit this issue by convincing a user to click on a maliciously crafted URL leading to a Web server running Internet Information Services (IIS) and Index Server. The attacker can exploit this issue to take control over the victim's session by using a UTF-7 encoded script embedded in the URL that the user clicked on. Successful exploitation of the vulnerability may result in arbitrary code execution on the target system. |
Protection Overview
The Update enables the HTTP Worm Catcher to detect and block the vulnerability based on pre-defined worm signatures.
In order for the protection to be activated, update your VPN-1/InterSpect/Connectra product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.