Fixlet Site - VulnerabilitiestoWindowsSystems Current Version: 147 Published: Tue, 16 Dec 2008 20:47:57 GMT New Fixlets: ============ *************************************************************** Title: Parameter Validation Memory Corruption Vulnerability Severity: High Fixlet ID: 523101 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5231.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4258 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Parameter Validation Memory Corruption Vulnerability." *************************************************************** Title: Charts Control Memory Corruption Vulnerability Severity: High Fixlet ID: 565101 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5651.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4256 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "Charts Control Memory Corruption Vulnerability." *************************************************************** Title: ISATAP Vulnerability Severity: High Fixlet ID: 568901 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5689.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3010 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate ISATAP addresses with the Local Intranet zone, which allows remote servers to capture NTLM credentials, and execute arbitrary code through credential-reflection attacks, by sending an authentication request, aka "ISATAP Vulnerability." *************************************************************** Title: HTML Objects Memory Corruption Vulnerability Severity: High Fixlet ID: 570601 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5706.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4259 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "HTML Objects Memory Corruption Vulnerability." *************************************************************** Title: Access Control Vulnerability Severity: High Fixlet ID: 577401 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5774.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4032 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions, which allows remote attackers to cause a denial of service (server load), obtain sensitive information, and "create scripts that would run in the context of the site" via requests to administrative URIs, aka "Access Control Vulnerability." *************************************************************** Title: Masked Edit Control Memory Corruption Vulnerability Severity: High Fixlet ID: 579401 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5794.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3704 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allows remote attackers to execute arbitrary code via a long Mask parameter, related to not "validating property values with boundary checks," as exploited in the wild in August 2008, aka "Masked Edit Control Memory Corruption Vulnerability." *************************************************************** Title: Hierarchical FlexGrid Control Memory Corruption Vulnerability Severity: High Fixlet ID: 580501 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5805.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4254 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: The Hierarchical FlexGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "Hierarchical FlexGrid Control Memory Corruption Vulnerability." *************************************************************** Title: HTML Rendering Memory Corruption Vulnerability Severity: High Fixlet ID: 582901 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5829.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4261 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Microsoft Internet Explorer 5.01 SP4, 6 SP1 on Windows 2000, and 6 on Windows XP and Server 2003 does not properly handle extraneous data associated with an object embedded in a web page, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "HTML Rendering Memory Corruption Vulnerability." *************************************************************** Title: DataGrid Control Memory Corruption Vulnerability Severity: High Fixlet ID: 589401 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5894.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4252 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "DataGrid Control Memory Corruption Vulnerability." *************************************************************** Title: Uninitialized Memory Corruption Vulnerability Severity: High Fixlet ID: 590301 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5903.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4260 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Microsoft Internet Explorer 7 sometimes attempts to access a deleted object, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Uninitialized Memory Corruption Vulnerability." *************************************************************** Title: SPN Vulnerability Severity: High Fixlet ID: 594201 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5942.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3009 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability." *************************************************************** Title: GDI Integer Overflow Vulnerability Severity: High Fixlet ID: 598401 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5984.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2249 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via a malformed header in a crafted WMF file, which triggers a buffer overflow, aka "GDI Integer Overflow Vulnerability." *************************************************************** Title: FlexGrid Control Memory Corruption Vulnerability Severity: High Fixlet ID: 599401 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval5994.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4253 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "FlexGrid Control Memory Corruption Vulnerability." *************************************************************** Title: Windows Common AVI Parsing Overflow Vulnerability Severity: High Fixlet ID: 603201 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval6032.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-4255 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: The Windows Common ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability." *************************************************************** Title: GDI Heap Overflow Vulnerability Severity: High Fixlet ID: 606201 Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval6062.html Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3465 Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo Fixlet Description: Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent attackers to cause a denial of service or execute arbitrary code via a WMF file with a malformed file-size parameter, which would not be properly handled by a third-party application that uses this API for a copy operation, aka "GDI Heap Overflow Vulnerability."