[793] in winnt
Fwd: Microsoft Security Bulletin MS02-013
daemon@ATHENA.MIT.EDU (Tim Brennan)
Tue Mar 5 09:05:33 2002
Message-Id: <5.1.0.14.2.20020305085937.00ace5d0@hesiod>
Date: Tue, 05 Mar 2002 09:05:22 -0500
To: winpartners@mit.edu
From: Tim Brennan <timb@MIT.EDU>
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="=====================_66219768==_.ALT"
--=====================_66219768==_.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed
fyi below - Does MIT have proxies in place - e.g., in some
labs/departments? (just curious) Thanks, Tim
>Reply-To:
><3_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com>
>From: "Microsoft"
><0_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com>
>To: <timb@mit.edu>
>Subject: Microsoft Security Bulletin MS02-013
>Date: Mon, 4 Mar 2002 15:08:02 -0800
>X-Mailer: Microsoft CDO for Windows 2000
>Thread-Index: AcHD0W31oFCcNW1BQpyy2wYm63jLTw==
>X-OriginalArrivalTime: 04 Mar 2002 23:08:38.0693 (UTC)
>FILETIME=[84D09D50:01C1C3D1]
>
>-----BEGIN PGP SIGNED MESSAGE-----
>
>- ----------------------------------------------------------------------
>Title: Java Applet Can Redirect Browser Traffic
>Date: 04 March 2002
>Software: Microsoft Virtual Machine
>Impact: Information Disclosure
>Max Risk: Critical
>Bulletin: MS02-013
>
>Microsoft encourages customers to review the Security Bulletin at:
>http://www.microsoft.com/technet/security/bulletin/MS02-013.asp.
>- ----------------------------------------------------------------------
>
>Issue:
>======
>The Microsoft VM is a virtual machine for the Win32 operating
>environment. It runs atop Microsoft Windows 95, Microsoft
>Windows 98, ME, Windows NT 4.0 , Windows 2000 and Windows XP.
>It ships as part of Windows 98, ME, and Windows 2000 and also as
>part of Internet Explorer 5.5 and earlier.
>
>The version of the Microsoft VM that ships with Internet Explorer
>version 4.x and 5.x contains a flaw affecting how Java requests
>for proxy resources are handled. A malicious Java applet could
>exploit this flaw to re-direct web traffic once it has left
>the proxy server to a destination of the attacker's choice.
>
>An attacker could use this flaw to send a user's Internet session
>to a system of his own control, without the user being aware of
>this. The attacker could then forward the information on to the
>intended destination, giving the appearance that the session was
>behaving normally. The attacker could then send his own malicious
>response, making it seem to come from the intended destination,
>or could discard the session information, creating the impression
>of a denial of service. Additionally, the attacker could capture
>and save the user's session information. This could enable him
>to execute a replay attack or to search for sensitive information
>such as user names or passwords.
>
>A system is only vulnerable if IE is used in conjunction with a
>proxy server. Users whose browsers are not behind a proxy server
>are not vulnerable to this vulnerability. However, those users
>would be vulnerable if they changed their browser to use a proxy
>server at a later date.
>
>Mitigating Factors:
>====================
> - The vulnerability only affects configurations that utilize a
> proxy server. Customers who are not using a proxy server are
> not at risk from this vulnerability.
>
> - Best practices strongly recommend using SSL to encrypt sensitive
> information such as user names, passwords and credit card numbers.
> If this has been done, sensitive information will be protected
> from examination and disclosure by an attacker exploiting this
> vulnerability.
>
>Risk Rating:
>============
> - Internet systems: Moderate
> - Intranet systems: Moderate
> - Client systems: Critical
>
>Patch Availability:
>===================
> - A patch is available to fix this vulnerability. Please read the
> Security Bulletin at
> http://www.microsoft.com/technet/security/bulletin/ms02-013.asp
> for information on obtaining this patch.
>
>Acknowledgment:
>===============
> - Harmen van der Wal (http://www.xs4all.nl/~harmwal/)
>
>- ---------------------------------------------------------------------
>
>THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
>PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
>ALL
>WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
>WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
>IN NO EVENT
>SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
>DAMAGES
>WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
>LOSS OF
>BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
>ITS
>SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
>STATES DO
>NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
>OR
>INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGP 7.1
>
>iQEVAwUBPIPLUY0ZSRQxA/UrAQHTkAf6A2u7iTDH5E6cWkwBZ4groGGXOP3wL5Cf
>namuVfMM7LMeLvqQWQ4C/GLtZYUwk/SMAIU8oGpY5ZqaTqWzweWkVipaKVbmg4Gk
>VumDVxFINc5JqvusOSLv2kUcNAXGxdS3QYXIuzt3DdiKl8x2HS9Fly/pTozlhtCP
>y3Jej+6ou7eGe3a7GyhRnSff7UeWEKyZQpYvIt9na5Xns8ljPd5RsTt1mQ2G06Wf
>WEJD0AaJ25i/25Tppw7zCx0e+mOjBeAy48roZpT7LD1qU49yOSwRDzWiFVwvsY0D
>6lcMOxmffhyBmZvEzqPVXeisJvrG7nS9MNctxkpNfM9Il7O56EVP7A==
>=FopK
>-----END PGP SIGNATURE-----
>
>
>
>*******************************************************************
>
>You have received this e-mail bulletin as a result of your subscription to
>the Microsoft Product Security Notification Service. For more
>information on this service, please visit
>http://www.microsoft.com/technet/security/notify.asp.
>
>To verify the digital signature on this bulletin, please download our PGP
>key at http://www.microsoft.com/technet/security/notify.asp.
>
>To cancel your subscription, click on the following link
>mailto:1_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com?subject=UNSUBSCRIBE
>to create an unsubscribe e-mail.
>
>To stop all e-mail newsletters from microsoft.com, click on the following
>link
>mailto:2_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com?subject=STOPMAIL
>to create an unsubscribe e-mail. You can manage all your Microsoft.com
>communication preferences from http://www.microsoft.com/misc/unsubscribe.htm
>
>For security-related information about Microsoft products, please visit
>the Microsoft Security Advisor web site at http://www.microsoft.com/security.
--=====================_66219768==_.ALT
Content-Type: text/html; charset="us-ascii"
<html>
<font size=3>fyi below - Does MIT have proxies in place - e.g., in some
labs/departments? (just curious) Thanks, Tim<br><br>
<blockquote type=cite class=cite cite>Reply-To:
<3_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com><br>
From: "Microsoft"
<0_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com><br>
To: <timb@mit.edu><br>
Subject: Microsoft Security Bulletin MS02-013<br>
Date: Mon, 4 Mar 2002 15:08:02 -0800<br>
X-Mailer: Microsoft CDO for Windows 2000<br>
Thread-Index: AcHD0W31oFCcNW1BQpyy2wYm63jLTw==<br>
X-OriginalArrivalTime: 04 Mar 2002 23:08:38.0693 (UTC)
FILETIME=[84D09D50:01C1C3D1]<br><br>
-----BEGIN PGP SIGNED MESSAGE-----<br><br>
-
----------------------------------------------------------------------<br>
Title: Java Applet Can Redirect Browser
Traffic<br>
Date: 04 March 2002<br>
Software: Microsoft Virtual Machine<br>
Impact: Information Disclosure<br>
Max Risk: Critical<br>
Bulletin: MS02-013<br><br>
Microsoft encourages customers to review the Security Bulletin at: <br>
<a href="http://www.microsoft.com/technet/security/bulletin/MS02-013.asp" eudora="autourl">http://www.microsoft.com/technet/security/bulletin/MS02-013.asp</a>.<br>
-
----------------------------------------------------------------------<br><br>
Issue:<br>
======<br>
The Microsoft VM is a virtual machine for the Win32 operating<br>
environment. It runs atop Microsoft Windows 95, Microsoft <br>
Windows 98, ME, Windows NT 4.0 , Windows 2000 and Windows XP.<br>
It ships as part of Windows 98, ME, and Windows 2000 and also as<br>
part of Internet Explorer 5.5 and earlier. <br><br>
The version of the Microsoft VM that ships with Internet Explorer<br>
version 4.x and 5.x contains a flaw affecting how Java requests<br>
for proxy resources are handled. A malicious Java applet could<br>
exploit this flaw to re-direct web traffic once it has left<br>
the proxy server to a destination of the attacker's choice. <br><br>
An attacker could use this flaw to send a user's Internet session<br>
to a system of his own control, without the user being aware of<br>
this. The attacker could then forward the information on to the<br>
intended destination, giving the appearance that the session was<br>
behaving normally. The attacker could then send his own malicious<br>
response, making it seem to come from the intended destination,<br>
or could discard the session information, creating the impression<br>
of a denial of service. Additionally, the attacker could capture<br>
and save the user's session information. This could enable him<br>
to execute a replay attack or to search for sensitive information<br>
such as user names or passwords. <br><br>
A system is only vulnerable if IE is used in conjunction with a<br>
proxy server. Users whose browsers are not behind a proxy server<br>
are not vulnerable to this vulnerability. However, those users<br>
would be vulnerable if they changed their browser to use a proxy<br>
server at a later date.<br><br>
Mitigating Factors:<br>
====================<br>
- The vulnerability only affects configurations that utilize
a<br>
proxy server. Customers who are not using a proxy server
are<br>
not at risk from this vulnerability. <br><br>
- Best practices strongly recommend using SSL to encrypt
sensitive<br>
information such as user names, passwords and credit card
numbers.<br>
If this has been done, sensitive information will be
protected<br>
from examination and disclosure by an attacker exploiting
this<br>
vulnerability.<br><br>
Risk Rating:<br>
============<br>
- Internet systems: Moderate<br>
- Intranet systems: Moderate<br>
- Client systems: Critical<br><br>
Patch Availability:<br>
===================<br>
- A patch is available to fix this vulnerability. Please read the
<br>
Security Bulletin at<br>
<a href="http://www.microsoft.com/technet/security/bulletin/ms02-013.asp" eudora="autourl">http://www.microsoft.com/technet/security/bulletin/ms02-013.asp</a><br>
for information on obtaining this patch.<br><br>
Acknowledgment:<br>
===============<br>
- Harmen van der Wal
(<a href="http://www.xs4all.nl/~harmwal/" eudora="autourl">http://www.xs4all.nl/~harmwal/</a>)<br><br>
-
---------------------------------------------------------------------<br><br>
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS <br>
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT
DISCLAIMS<br>
ALL <br>
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE <br>
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.<br>
IN NO EVENT <br>
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY<br>
DAMAGES <br>
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,<br>
LOSS OF <br>
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION
OR<br>
ITS <br>
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
SOME<br>
STATES DO <br>
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
CONSEQUENTIAL<br>
OR <br>
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.<br><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: PGP 7.1<br><br>
iQEVAwUBPIPLUY0ZSRQxA/UrAQHTkAf6A2u7iTDH5E6cWkwBZ4groGGXOP3wL5Cf<br>
namuVfMM7LMeLvqQWQ4C/GLtZYUwk/SMAIU8oGpY5ZqaTqWzweWkVipaKVbmg4Gk<br>
VumDVxFINc5JqvusOSLv2kUcNAXGxdS3QYXIuzt3DdiKl8x2HS9Fly/pTozlhtCP<br>
y3Jej+6ou7eGe3a7GyhRnSff7UeWEKyZQpYvIt9na5Xns8ljPd5RsTt1mQ2G06Wf<br>
WEJD0AaJ25i/25Tppw7zCx0e+mOjBeAy48roZpT7LD1qU49yOSwRDzWiFVwvsY0D<br>
6lcMOxmffhyBmZvEzqPVXeisJvrG7nS9MNctxkpNfM9Il7O56EVP7A==<br>
=FopK<br>
-----END PGP SIGNATURE-----<br><br>
<br><br>
*******************************************************************<br><br>
You have received this e-mail bulletin as a result of your subscription
to the Microsoft Product Security Notification Service.
For more information on this service, please visit
<a href="http://www.microsoft.com/technet/security/notify.asp" eudora="autourl">http://www.microsoft.com/technet/security/notify.asp</a>.<br><br>
To verify the digital signature on this bulletin, please download our PGP
key at
<a href="http://www.microsoft.com/technet/security/notify.asp" eudora="autourl">http://www.microsoft.com/technet/security/notify.asp</a>.<br><br>
To cancel your subscription, click on the following link
<a href="mailto:1_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com%3Fsubject=UNSUBSCRIBE" eudora="autourl">mailto:1_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com?subject=UNSUBSCRIBE</a>
to create an unsubscribe e-mail.<br><br>
To stop all e-mail newsletters from microsoft.com, click on the following link <a href="mailto:2_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com%3Fsubject=STOPMAIL" eudora="autourl">mailto:2_26728_324C2A43-1EB2-4E8B-8635-9F747B889D16_US@Newsletters.Microsoft.com?subject=STOPMAIL</a> to create an unsubscribe e-mail. You can manage all your Microsoft.com communication preferences from <a href="http://www.microsoft.com/misc/unsubscribe.htm" eudora="autourl">http://www.microsoft.com/misc/unsubscribe.htm</a><br><br>
For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at <a href="http://www.microsoft.com/security" eudora="autourl">http://www.microsoft.com/security</a>. </font></blockquote></html>
--=====================_66219768==_.ALT--
