-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

           ESB-2003.0046 -- Microsoft Security Bulletin MS03-002
     Cumulative Patch for Microsoft Content Management Server (810487)
                              23 January 2003

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                Content Management Server 2001
Vendor:                 Microsoft
Operating System:       Windows
Impact:                 Execute Arbitrary Code/Commands
                        Provide Misleading Information
Access Required:        Remote

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ----------------------------------------------------------------------
Title:      Cumulative Patch for Microsoft Content Management Server
            (810487)
Date:       22 January 2003
Software:   Microsoft Content Management Server 2001
Impact:     Information Disclosure
Max Risk:   Moderate
Bulletin:   MS03-002

Microsoft encourages customers to review the Security Bulletins at: 
http://www.microsoft.com/technet/security/bulletin/MS03-002.asp
http://www.microsoft.com/security/security_bulletins/ms03-002.asp
- - ----------------------------------------------------------------------

Issue:
======
Microsoft Content Management Server (MCMS) 2001 is an Enterprise
Server product that simplifies developing and managing E-Commerce
web sites. MCMS includes a number of pre-defined ASP web pages that
allow web site operators to quickly set up E-business websites.
 
A Cross-Site Scripting flaw exists in one of these ASP pages that
could allow an attacker to insert script into the data being sent
to a MCMS server. Because the server generates a web page in
response to a user request made using this page, it is possible that
the script could be embedded within the page that CMS generates and
returns to the user, this script would then run when processed by
the user's browser. This could result in an attacker being able to
access information the user shared with the legitimate site.
 
An attacker might attempt to exploit this flaw by crafting a
malicious link to a valid site that the user intended to visit.
If the attacker were able to get a user to click the link-most
likely by sending the link in an email-then it could be possible
for the attacker to take a variety of actions. The attacker could
alter the data that appeared to be contained on the web pages
presented by the legitimate site, monitor the user's session with
the legitimate site and copy personal data from the legitimate site
to a site under the attacker's control, or access the legitimate
site's cookies.

Mitigating Factors:
====================
 - This flaw is not present in Microsoft Content Management
   Server 2002. 
 - The attacker would have no way to force users to visit
   the malicious site. Instead, the attacker would need to
   lure them there, typically by getting them to click on
   a link that would take them to the attacker's site.

Risk Rating:
============
 - Moderate

Patch Availability:
===================
 - A patch is available to fix this vulnerability. Please read the 
   Security Bulletins at
   http://www.microsoft.com/technet/security/bulletin/ms03-002.asp
   http://www.microsoft.com/security/security_bulletins/ms03-002.asp

   for information on obtaining this patch.


- - ---------------------------------------------------------------------

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS 
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL 
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE 
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT 
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES 
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF 
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
ITS 
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO 
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR 
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

- -----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQEVAwUBPi7heI0ZSRQxA/UrAQEmzAgAgID/nmgK4Azm+gzggSq5H3O3eg0jJ9IX
BTK1PUMnJtbQGTftRXgNKeKox/vJfnmVPiz2mm0XVXpA8FhYD8PFZzgzf1CRjy6u
xw+Z/BNKF2thkwP3vCCdArHk+cDQukaMQPjSB7Pq7GdAo2gjlnomnIEXpjxogGYr
LMyjKL2Z5YkgJjdYMF2BIsrSdnMtyH551K9/+gUSy5C9KDCKFbmfAFWFdIwouzad
iF6g+STuFagTXycvFKitY1lauTqGtiVEzTACbwfQmfGNZgMWHMHMMnaBj/VAXWI/
DJFcDVGMYjk3y6hxSkvUvVQb4/oJEVuwuDuCsNhnAtjIOXh/5AneLQ==
=qa7Y
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBPjAlryh9+71yA2DNAQEeSAP6AxN5JEoCPL1Qny1VdmA3Mc+b+33WrwCI
v+mlW+XReZSpGeXD8IN3O5zYlVMDaninKUWLb5Lmec+efFwQTrZQUiZ6Z4fWvEA5
9COeWOL6iiWC+c3NgnKlCdMX9InyICxPEwxI3967qunfaa6j2v4goqcZwq5wvKWX
0/UR8v3gtjU=
=2Qez
-----END PGP SIGNATURE-----