Re: Microsoft Baseline Security Analyzer exploit (Exposed vulnerabilities' list)

From: 3APA3A (3APA3Aat_private)
Date: Thu Apr 25 2002 - 01:51:44 PDT

  • Next message: Menashe Eliezer: "RE: Microsoft Baseline Security Analyzer exploit (Exposed vulnerabilities' list)" 

    Dear Menashe Eliezer,

Sorry  for  asking,  but  it's  unclear from advisory: is it possible to
access reports with either:

1. ActiveX element marked safe for scripting
2. Javascript or VBscript from "Internet" security zone

Examples  you give for scripting will only run in local host content, so
this  problem  seems to be local only (default permissions for sensitive
files)  with  minimal  impact,  because  analysis  of  security  policy,
registry  and  file  permissions can (mostly) be done by local user with
unprivileged account. In this case risk is low.

--Thursday, April 25, 2002, 5:06:32 AM, you wrote to bugtraqat_private:

ME> Microsoft Baseline Security Analyzer exploit (Exposed vulnerabilities' list)
ME> Finjan Software Security Advisory
ME> URL: http://www.finjan.com/mcrc/alert_show.cfm?attack_release_id=71
ME> April 24, 2002
ME> Risk: Medium
ME> -------------



-- 
~/ZARAZA
Человек это тайна... я занимаюсь этой тайной чтобы быть человеком. (Достоевский)

    This archive was generated by hypermail 2b30 : Thu Apr 25 2002 - 22:37:51 PDT