Security Lab

Раскрытие данных в Microsoft XML Editor

Дата публикации:23.06.2011
Дата изменения:25.01.2012
Всего просмотров:965
Опасность:
Низкая
Наличие исправления: Да
Количество уязвимостей:1
CVSSv2 рейтинг: 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N/E:U/RL:O/RC:C)
CVE ID: CVE-2011-1280
Вектор эксплуатации: Удаленная
Воздействие: Раскрытие важных данных
CWE ID: Нет данных
Наличие эксплоита: Нет данных
Уязвимые продукты: Microsoft InfoPath 2010
Microsoft Office InfoPath 2007
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Compact Edition 3.x
Microsoft SQL Server 2005 Express Edition
Microsoft SQL Server 2008
Microsoft SQL Server Management Studio Express 2005
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Уязвимые версии: Microsoft InfoPath 2010
Microsoft Office InfoPath 2007
Microsoft SQL Server 2005
Microsoft SQL Server 2008
Microsoft SQL Server Management Studio Express 2005
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual Studio 2010

Описание:
Уязвимость позволяет удаленному пользователю получить доступ к важным данным.

Уязвимость существует из-за ошибки при получении внешних XML данных в Web Service Discovery (.disco) файле. Удаленный пользователь может при помощи специально сформированного файла .disco просмотреть содержимое произвольных файлов системы.

URL производителя: www.microsoft.com

Решение: Установите исправление с сайта производителя.

Microsoft Office Software

Microsoft InfoPath 2007 Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=88eedb0b-a2cf-4a1b-b1b9-0b2926c25872

Microsoft InfoPath 2010 (32-bit editions)
http://www.microsoft.com/downloads/details.aspx?familyid=90ffe910-bd9c-48aa-8007-2b43e1a99999

Microsoft InfoPath 2010 (64-bit editions)
http://www.microsoft.com/downloads/details.aspx?familyid=f3244003-fb63-44d8-bedc-6399c39aacba

 

Microsoft SQL Server

GDR Software Updates

SQL Server 2005 Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=faca7f7a-c346-48e3-9bf5-f140a51aae4e

SQL Server 2005 x64 Edition Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=faca7f7a-c346-48e3-9bf5-f140a51aae4e

SQL Server 2005 for Itanium-based Systems Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=faca7f7a-c346-48e3-9bf5-f140a51aae4e

SQL Server 2005 Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2aba4a2e-477f-4267-9ebe-ab7b29d218ad

SQL Server 2005 x64 Edition Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2aba4a2e-477f-4267-9ebe-ab7b29d218ad

SQL Server 2005 for Itanium-based Systems Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2aba4a2e-477f-4267-9ebe-ab7b29d218ad

SQL Server 2005 Express Edition Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=faca7f7a-c346-48e3-9bf5-f140a51aae4e

SQL Server 2005 Express Edition Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2aba4a2e-477f-4267-9ebe-ab7b29d218ad

SQL Server 2005 Express Edition with Advanced Services Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2aba4a2e-477f-4267-9ebe-ab7b29d218ad

SQL Server Management Studio Express (SSMSE) 2005
http://www.microsoft.com/downloads/details.aspx?familyid=34c3ba21-b158-4e6d-82ba-831053d41161

SQL Server Management Studio Express (SSMSE) 2005 x64 Edition
http://www.microsoft.com/downloads/details.aspx?familyid=34c3ba21-b158-4e6d-82ba-831053d41161

SQL Server 2008 for 32-bit Systems Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=ae7db514-d96b-4cff-a13d-c74f4cf8cf0c

SQL Server 2008 for x64-based Systems Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=ae7db514-d96b-4cff-a13d-c74f4cf8cf0c

SQL Server 2008 for Itanium-based Systems Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=ae7db514-d96b-4cff-a13d-c74f4cf8cf0c

SQL Server 2008 for 32-bit Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=6f4767bf-257d-4822-b768-7b6702261276

SQL Server 2008 for x64-based Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=6f4767bf-257d-4822-b768-7b6702261276

SQL Server 2008 for Itanium-based Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=6f4767bf-257d-4822-b768-7b6702261276

SQL Server 2008 R2 for 32-bit Systems
http://www.microsoft.com/downloads/details.aspx?familyid=80e98567-1b28-49b1-a646-579f8c115a41

SQL Server 2008 R2 for x64-based Systems
http://www.microsoft.com/downloads/details.aspx?familyid=80e98567-1b28-49b1-a646-579f8c115a41

SQL Server 2008 R2 for Itanium-based Systems
http://www.microsoft.com/downloads/details.aspx?familyid=80e98567-1b28-49b1-a646-579f8c115a41

 

QFE Software Updates

SQL Server 2005 Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=d214763c-5a16-4959-90ff-08112345d867

SQL Server 2005 x64 Edition Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=d214763c-5a16-4959-90ff-08112345d867

SQL Server 2005 for Itanium-based Systems Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=d214763c-5a16-4959-90ff-08112345d867

SQL Server 2005 Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2975ad1a-1852-4771-b3fa-2be79899be57

SQL Server 2005 x64 Edition Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2975ad1a-1852-4771-b3fa-2be79899be57

SQL Server 2005 for Itanium-based Systems Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2975ad1a-1852-4771-b3fa-2be79899be57

SQL Server 2005 Express Edition Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=d214763c-5a16-4959-90ff-08112345d867

SQL Server 2005 Express Edition Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2975ad1a-1852-4771-b3fa-2be79899be57

SQL Server 2005 Express Edition with Advanced Services Service Pack 3
http://www.microsoft.com/downloads/details.aspx?familyid=d214763c-5a16-4959-90ff-08112345d867

SQL Server 2005 Express Edition with Advanced Services Service Pack 4
http://www.microsoft.com/downloads/details.aspx?familyid=2975ad1a-1852-4771-b3fa-2be79899be57

SQL Server 2008 for 32-bit Systems Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=312a39c4-cb32-4216-8672-1b1c0937ba6c

SQL Server 2008 for x64-based Systems Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=312a39c4-cb32-4216-8672-1b1c0937ba6c

SQL Server 2008 for Itanium-based Systems Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=312a39c4-cb32-4216-8672-1b1c0937ba6c

SQL Server 2008 for 32-bit Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=23240963-e2c6-4d40-8179-661117b53e91

SQL Server 2008 for x64-based Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=23240963-e2c6-4d40-8179-661117b53e91

SQL Server 2008 for Itanium-based Systems Service Pack 2
http://www.microsoft.com/downloads/details.aspx?familyid=23240963-e2c6-4d40-8179-661117b53e91

SQL Server 2008 R2 for 32-bit Systems
http://www.microsoft.com/downloads/details.aspx?familyid=9df95137-d1b3-4fac-8958-8042aa2010c4

SQL Server 2008 R2 for x64-based Systems
http://www.microsoft.com/downloads/details.aspx?familyid=9df95137-d1b3-4fac-8958-8042aa2010c4

SQL Server 2008 R2 for Itanium-based Systems
http://www.microsoft.com/downloads/details.aspx?familyid=9df95137-d1b3-4fac-8958-8042aa2010c4

 

Developer Tools

Microsoft Visual Studio 2005 Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=e5ce8a9a-e89b-4095-9f21-7e6f307fbf2b

Microsoft Visual Studio 2008 Service Pack 1
http://www.microsoft.com/downloads/details.aspx?familyid=cc01bce9-3f38-4590-9c6e-a4048c886d33

Microsoft Visual Studio 2010
http://www.microsoft.com/downloads/details.aspx?familyid=213b820f-dcba-4895-b339-b50eeb92524d

Ссылки: MS11-049: Vulnerability in the Microsoft XML Editor Could Allow Information Disclosure (2543893)
Журнал изменений: a:2:{s:4:"TEXT";s:43:"25.01.2012
Незначительные изменения.";s:4:"TYPE";s:4:"html";}