| The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them. |
|
 |
|
|
Computer vulnerabilities of Microsoft BizTalk Server
Windows, BizTalk Server: Cross Site Scripting of UDDI Services
Synthesis of the vulnerability
An attacker can trigger a Cross Site Scripting in UDDI Services of Windows/BizTalk, in order to run JavaScript code in the context of the web site.
Impacted products: BizTalk Server, Windows 2008 R0.
Severity: 2/4.
Consequences: client access/rights.
Provenance: document.
Creation date: 11/08/2015.
Identifiers: 3082459, CERTFR-2015-AVI-341, CVE-2015-2475, MS15-087, VIGILANCE-VUL-17637.
Description of the vulnerability
The UDDI Services is used by Windows and Microsoft BizTalk Server.
However, it does not filter received data before inserting them in generated HTML documents.
An attacker can therefore trigger a Cross Site Scripting in UDDI Services of Windows/BizTalk, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial) |
Windows: code execution via MSCOMCTL.OCX
Synthesis of the vulnerability
An attacker can invite the victim to browse a web page loading the MSCOMCTL.OCX ActiveX, in order to execute code on his computer.
Impacted products: BizTalk Server, Office, Access, Office Communicator, Excel, InfoPath, OneNote, Outlook, PowerPoint, Project, Publisher, Visio, Word, SQL Server, Visual Studio, Windows 2003, Windows 2008 R0, Windows 2008 R2, Windows 7, Windows Vista, Windows XP.
Severity: 4/4.
Consequences: user access/rights.
Provenance: document.
Creation date: 11/04/2012.
Identifiers: 2664258, BID-52911, CERTA-2012-AVI-206, CVE-2012-0158, MS12-027, VIGILANCE-VUL-11529.
Description of the vulnerability
The MSCOMCTL.OCX file is installed by several Microsoft products:
- Microsoft Office
- Microsoft SQL Server
- Microsoft BizTalk Server
- Microsoft Commerce Server
- Microsoft Visual FoxPro
- Visual Basic
This file contains the Windows Common Controls ActiveX controls (MSCOMCTL.TreeView, MSCOMCTL.ListView2, MSCOMCTL.TreeView2, and MSCOMCTL.ListView).
A buffer overflow in these ActiveX leads to code execution.
An attacker can therefore invite the victim to browse a web page loading the MSCOMCTL.OCX ActiveX, in order to execute code on his computer.
Full Vigil@nce bulletin... (Free trial) |
Office Web Components: several vulnerabilities
Synthesis of the vulnerability
An attacker can use several vulnerabilities of Office Web Components ActiveX, in order to execute code on victim's computer.
Impacted products: BizTalk Server, ISA, Office, Access, Excel, Outlook, PowerPoint, Project, Publisher, Visio, Word, Visual Studio.
Severity: 4/4.
Consequences: user access/rights.
Provenance: document.
Number of vulnerabilities in this bulletin: 4.
Creation date: 12/08/2009.
Identifiers: 957638, BID-35642, BID-35990, BID-35991, BID-35992, CERTA-2009-AVI-331, CVE-2009-0562, CVE-2009-1136, CVE-2009-1534, CVE-2009-2496, MS09-043, VIGILANCE-VUL-8943, VU#545228, ZDI-09-054, ZDI-09-055, ZDI-09-056.
Description of the vulnerability
Microsoft Office Web Components are installed with Office, BizTalk, Visual Studio and ISA, and provide ActiveX to publish spreadsheets and charts on a web site.
An attacker can generate an error during memory allocation, after an ActiveX has been loaded and unloaded, leading to code execution. [severity:4/4; BID-35990, CERTA-2009-AVI-331, CVE-2009-0562, ZDI-09-055]
An attacker can generate a heap memory corruption in BorderAround(). [severity:4/4; BID-35991, CVE-2009-2496, ZDI-09-056]
An attacker can use invalid parameters in order to corrupt the memory in msDataSourceObject() (VIGILANCE-VUL-8854). [severity:4/4; BID-35642, CVE-2009-1136, VU#545228, ZDI-09-054]
An attacker can generate a buffer overflow. [severity:4/4; BID-35992, CVE-2009-1534]
An attacker can therefore create an HTML page containing one of these ActiveX in order to execute code on victim's computer.
Full Vigil@nce bulletin... (Free trial) |
Microsoft Office Web Components: memory corruption
Synthesis of the vulnerability
An attacker can invite the victim to see an HTML page in order to corrupt the memory of a Microsoft Office Web Components ActiveX, leading to code execution.
Impacted products: BizTalk Server, IE, ISA, Office, Access, Excel, Microsoft FrontPage, OneNote, Outlook, PowerPoint, Project, Publisher, Visio, Word, Visual Studio.
Severity: 4/4.
Consequences: user access/rights.
Provenance: document.
Creation date: 15/07/2009.
Identifiers: 957638, 973472, BID-35642, CVE-2009-1136, FGA-2009-27, MS09-043, VIGILANCE-VUL-8854, VU#545228.
Description of the vulnerability
Microsoft Office Web Components are installed with Office and ISA, and provide ActiveX to publish spreadsheets and charts on a web site.
The OWC10.Spreadsheet ActiveX displays an Excel spreadsheet. Its Evaluate() and msDataSourceObject() methods do not correctly validate number arrays, which corrupts the memory.
An attacker can therefore invite the victim to see an HTML page in order to corrupt the memory of a Microsoft Office Web Components ActiveX, leading to code execution.
Full Vigil@nce bulletin... (Free trial) |
Office, Visual, BizTalk, Commerce, ISA: vulnerabilities
Synthesis of the vulnerability
Two vulnerabilities of Microsoft Office, Visual Studio .NET, BizTalk Server, Commerce Server and Internet Security and Acceleration Server products can be used to execute code.
Impacted products: BizTalk Server, ISA, Office, Access, Excel, Outlook, PowerPoint, Publisher, Word, Visual Studio.
Severity: 3/4.
Consequences: privileged access/rights, user access/rights.
Provenance: document.
Number of vulnerabilities in this bulletin: 2.
Creation date: 12/03/2008.
Identifiers: 933103, BID-28135, BID-28136, CERTA-2008-AVI-127, CVE-2006-4695, CVE-2007-1201, MS08-017, VIGILANCE-VUL-7657, VU#654577.
Description of the vulnerability
Two vulnerabilities impact Microsoft Office Web Components 2000 (provided with Microsoft Office, Visual Studio .NET, BizTalk Server, Commerce Server and Internet Security and Acceleration Server).
An attacker can create a HTML page using a malicious uri in order to execute code in an ActiveX of Microsoft Office Web Components. [severity:3/4; BID-28135, CVE-2006-4695, VU#654577]
An attacker can create a HTML page using malicious data in order to execute code in an ActiveX of Microsoft Office Web Components. [severity:3/4; BID-28136, CVE-2007-1201]
Full Vigil@nce bulletin... (Free trial) |
Our database contains other pages. You can request a free trial to read them.
Display information about Microsoft BizTalk Server:
|