Cumulative Patch for Microsoft MMS New

A security vulnerability exists in the Microsoft Content Management Server (MCMS) that could allow an attacker to insert script into the data being sent to a MCMS server.

Issue

Microsoft Content Management Server (MCMS) 2001 is an Enterprise Server product that simplifies developing and managing E-Commerce web sites. MCMS includes a number of pre-defined ASP web pages that allow web site operators to quickly set up E-business websites.

A Cross-Site Scripting flaw exists in one of these ASP pages that could allow an attacker to insert script into the data being sent to a MCMS server. Because the server generates a web page in response to a user request made using this page, it is possible that the script could be embedded within the page that CMS generates and returns to the user, this script would then run when processed by the user’s browser. This could result in an attacker being able to access information the user shared with the legitimate site.

An attacker might attempt to exploit this flaw by crafting a malicious link to a valid site that the user intended to visit. If the attacker were able to get a user to click the link—most likely by sending the link in an email—then it could be possible for the attacker to take a variety of actions. The attacker could alter the data that appeared to be contained on the web pages presented by the legitimate site, monitor the user’s session with the legitimate site and copy personal data from the legitimate site to a site under the attacker’s control, or access the legitimate site's cookies.

Affected Products

• Microsoft Content Management Server 2001

Download

Patch: http://download.microsoft.com/download/5/9/3/5936344a-480c-4343-bcea-b3f6aa25fa23/mcms2001srp2.exe

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: January 22, 2003

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<