MS01-022: WebDAV Service Provider Can Allow Scripts to Levy Requests as a UserArticle ID: 296441 - View products that this article applies to. This article was previously published under Q296441 SYMPTOMS The Microsoft Data Access Component Internet Publishing
Provider provides access to Web Distributed Authoring and Versioning (WebDAV)
resources over the Internet. By design, it should differentiate between
requests that are made by a user and those that are made by a script that is
running in the user's browser. However, because of an implementation flaw, it
handles all requests in the security context of the user. Therefore, if a user
browses to a Web page or opens an HTML e-mail message that contains script,
that script could access Web-based resources as the user. The specific actions that a malicious user could take by using this vulnerability would depend on the Web-based resources that are available to the user, and on the user's privileges on those resources. However, it is likely that at a minimum, the malicious user could browse the user's intranet, and potentially access Web-based e-mail messages as well. Notes:
RESOLUTION
A supported hotfix is now available from Microsoft, but it is only intended to
correct the problem that this article describes. Apply it only to systems that
you determine are at risk of attack. Evaluate the computer's physical
accessibility, network and Internet connectivity, and other factors to
determine the degree of risk to the computer. See the associated
Microsoft
Security Bulletin
(http://www.microsoft.com/technet/security/bulletin/MS01-022.mspx)
to help determine the degree of risk. This hotfix
may receive additional testing. If the computer is sufficiently at risk, we
recommend that you apply this hotfix now. To resolve this problem immediately, download the hotfix by following the instructions later in this article or contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site: http://support.microsoft.com/contactus/?ws=support Note In special cases, charges that are ordinarily incurred for
support calls may be canceled, if a Microsoft Support Professional determines
that a specific update will resolve your problem. The usual support costs will
apply to additional support questions and issues that do not qualify for the
specific update in question.
You can install this patch on any of the following
operating systems:
(http://support.microsoft.com/contactus/?ws=support)
Collapse this image 
(http://www.microsoft.com/Downloads/details.aspx?displaylang=en&FamilyID=046E5A26-54D8-4AAB-B3B1-0050C267C2B2)
119591 Microsoft scanned this file for viruses. Microsoft used the most
current virus-detection software that was available on the date that the file
was posted. The file is stored on security-enhanced servers that help to
prevent any unauthorized changes to the file.
The English version of this fix should have the
following file attributes or later:
(http://support.microsoft.com/kb/119591/EN-US/
)
How to Obtain Microsoft Support Files from Online Services
Date Time Version Size File name ------------------------------------------------------ 04/05/2001 12:45p 8.102.4004.0 561,152 Msdaipp.10 04/04/2001 05:59p 8.103.4004.0 573,440 Msdaipp.15 04/08/2001 01:10p 45,056 Rb_inst.exe STATUSMicrosoft has confirmed that this problem
may cause a degree of security vulnerability in the Microsoft products that are
listed at the beginning of this article. MORE INFORMATIONFor additional information about how
to obtain a hotfix for Windows 2000 Datacenter Server, click the article number
below to view the article in the Microsoft Knowledge Base: 265173 For additional information about how to install multiple
hotfixes with only one reboot, click the article number below to view the
article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/265173/EN-US/
)
The Datacenter Program and Windows 2000 Datacenter Server Product
296861 To determine if your computer is vulnerable, find
the Msdaipp.dll file on your computer. If this file is not present, your
computer is not affected by this vulnerability and you do not need the patch.
If this file is present, right-click the file, click Properties, click the Version tab, and then compare the version to the versions that are listed
below:
(http://support.microsoft.com/kb/296861/EN-US/
)
Use QChain.exe to Install Multiple Hotfixes with One Reboot
Collapse this table
http://www.microsoft.com/technet/security/bulletin/MS01-022.mspx
(http://www.microsoft.com/technet/security/bulletin/MS01-022.mspx)
PropertiesArticle ID: 296441 - Last Review: March 29, 2007 - Revision: 5.3 APPLIES TO
|
| United States | Change | | | All Microsoft Sites |
Select the product you need help with
Back to the top
