Re: Microsoft Baseline Security Analyzer exploit (Exposed vulnerabilities' list)

[3APA3A <3APA3A () SECURITY NNOV RU>]

Dear Menashe Eliezer,

Sorry  for  asking,  but  it's  unclear from advisory: is it possible to
access reports with either:

1. ActiveX element marked safe for scripting
2. Javascript or VBscript from "Internet" security zone

Examples  you give for scripting will only run in local host content, so
this  problem  seems to be local only (default permissions for sensitive
files)  with  minimal  impact,  because  analysis  of  security  policy,
registry  and  file  permissions can (mostly) be done by local user with
unprivileged account. In this case risk is low.

--Thursday, April 25, 2002, 5:06:32 AM, you wrote to bugtraq () securityfocus com:

ME> Microsoft Baseline Security Analyzer exploit (Exposed vulnerabilities' list)
ME> Finjan Software Security Advisory
ME> URL: http://www.finjan.com/mcrc/alert_show.cfm?attack_release_id=71
ME> April 24, 2002
ME> Risk: Medium
ME> -------------



-- 
~/ZARAZA
×åëîâåê ýòî òàéíà... ÿ çàíèìàþñü ýòîé òàéíîé ÷òîáû áûòü ÷åëîâåêîì. (Äîñòîåâñêèé)