CVE-2002-0057 XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an....
MediumCVSS 5.0
EPSS 23.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
XMLHTTP control in Microsoft XML Core Services 2.6 and later does not properly handle IE Security Zone settings, which allows remote attackers to read arbitrary files by specifying a local file as an XML Data Source.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 6.0 | No fix listed |
| Microsoft sql server | = 2000 | No fix listed |
| Microsoft sql server | = 2000-sp1 | No fix listed |
| Microsoft sql server | = 2000-sp2 | No fix listed |
| Microsoft xml core services | = 2.6 | No fix listed |
| Microsoft xml core services | = 3.0 | No fix listed |
| Microsoft xml core services | = 4.0 | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20011214 MSIE6 can read local files mailing-list vendor-advisory
- 20020212 Update on the MS02-005 patch, holes still remain mailing-list
- 3032 vdb-entry
- 3699 vdb-entry
- MS02-008 vendor-advisory
- ie-xmlhttp-redirect(7712) vdb-entry