Login or Register to Ask a Question and Join Our Community


Security Advisories (RSS) - Microsoft

Microsoft Security Advisory (2501696): Vulnerability in MHTML Could Allow Information Disclosure - 3

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Windows & DOS: Issues & Discussions Security Advisories (RSS) - Microsoft Microsoft Security Advisory (2501696): Vulnerability in MHTML Could Allow Information Disclosure - 3
# 1  
Old 03-11-2011
Microsoft Security Advisory (2501696): Vulnerability in MHTML Could Allow Information Disclosure - 3
Revision Note: V1.1 (March 11, 2011): Revised Executive Summary to reflect investigation of limited, targeted attacks. Advisory Summary:Microsoft is investigating new public reports of a vulnerability in all supported editions of Microsoft Windows. The vulnerability could allow an attacker to cause a victim to run malicious scripts when visiting various Web sites, resulting in information disclosure. This impact is similar to server-side cross-site scripting (XSS) vulnerabilities. Microsoft is aware of published information and proof-of-concept code that attempts to exploit this vulnerability. In addition, at this time, Microsoft is aware of public proof-of-concept code being used in limited, targeted attacks. Users who have applied the automated Microsoft Fix it solution described in Microsoft Knowledge Base Article 2501696 or manually applied the "Enable the MHTML protocol lockdown" workaround described in this advisory to their systems are not exposed to this vulnerability.

More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question

LEARN ABOUT OPENSOLARIS

mech_spnego

mech_spnego(5)						Standards, Environments, and Macros					    mech_spnego(5)

NAME

       mech_spnego - Simple and Protected GSS-API Negotiation Mechanism

SYNOPSIS

       /usr/lib/gss/mech_spnego.so.1

DESCRIPTION

       The  SPNEGO security mechanism for GSS-API allows GSS-API applications to negotiate the actual security mechanism to be used in the GSS-API
       session. mech_spnego.so.1 is a shared object module that is dynamically opened by applications that specify the	SPNEGO	Object	Identifier
       (OID) in calls to the GSS-API functions (see libgss(3LIB)).

       SPNEGO  is  described  by  IETF	RFC 2478 and is intended to be used in environments where multiple GSS-API mechanisms are available to the
       client or server and neither side knows what mechanisms are supported by the other.

       When SPNEGO is used, it selects the list of mechanisms to advertise by reading the GSS mechanism  configuration	file,  /etc/gss/mech  (see
       mech(4)), and by listing all active mechanisms except for itself.

OPTIONS

       SPNEGO may be configured to function in two ways. The first way is to interoperate with Microsoft SSPI clients and servers that use the Mi-
       crosoft "Negotiate" method, which is also based on SPNEGO. The Microsoft "Negotiate" mechanism does  not  strictly  follow  the	IETF  RFC.
       Therefore, use special handling in order to enable full interoperability. In order to interoperate, place option "[ msinterop ]" at the end
       of the SPNEGO line in /etc/gss/mech.

       This is an example (from /etc/gss/mech):

	 spnego    1.3.6.1.5.5.2  mech_spnego.so [ msinterop ]

       Without the "[ msinterop ]" option, mech_spnego will follow the strict IETF RFC 2478 specification and will not be able to  negotiate  with
       Microsoft applications that try to use the SSPI "Negotiate" mechanism.

INTERFACES

       mech_spnego.so.1  has  no  public  interfaces.  It  is  only  activated and used through the GSS-API interface provided by libgss.so.1 (see
       libgss(3LIB)).

FILES

       /usr/lib/gss/mech_spnego.so.1

	   shared object file

       /usr/lib/sparcv9/gss/mech_spnego.so.1

	   SPARC 64-bit shared object file

       /usr/lib/amd64/gss/mech_spnego.so.1

	   x86 64-bit shared object file

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUWNspnego		   |
       +-----------------------------+-----------------------------+
       |MT Level		     |Safe			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       Intro(3), libgss(3LIB), mech(4), attributes(5)

       Solaris Security for Developers Guide

SunOS 5.11							    4 Oct 2004							    mech_spnego(5)