Microsoft Windows / Internet Explorer File Download Extension Spoofing
http://secunia.com/advisories/12058/


Secunia Advisory: SA12058
Release Date: 2004-07-13

Critical: Moderately critical
Impact: Security Bypass
Where: From remote

OS: Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows NT 4.0 Server
Microsoft Windows NT 4.0 Server, Terminal Server Edition
Microsoft Windows NT 4.0 Workstation
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional

Choose a product and view comprehensive vulnerability statistics and
all Secunia advisories affecting it.

CVE reference: CAN-2004-0420

Description:
Microsoft has issued an update for Microsoft Windows. This fixes a
vulnerability, allowing malicious web sites to spoof the extension of
files being downloaded.

For more information:
SA10736

Solution:
Apply patches.

Microsoft Windows NT Workstation 4.0 (requires SP6a):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows NT Server 4.0 (requires SP6a):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows NT Server 4.0 Terminal Server Edition (requires
SP6a):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows NT® Workstation 4.0 and NT Server 4.0 with Active
Desktop (requires SP6a):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows 2000 (requires SP2, SP3 or SP4) :
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows XP (requires SP1):
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows XP 64-Bit Edition:
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows XP 64-Bit Edition Version 2003:
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows Server 2003:
http://www.microsoft.com/downloa...-...displaylang=en

Microsoft Windows Server 2003 64-Bit Edition:
http://www.microsoft.com/downloa...-...displaylang=en

Original Advisory:
MS04-024 (KB839645):
http://www.microsoft.com/technet/sec.../MS04-024.mspx

Other References:
SA10736:
http://secunia.com/advisories/10736/



--
Meritorios de Filtrado (Kill-File Global):
tella llop, jm (N.B. 2003.10.25)


«Prefiero molestar con la verdad que complacer con adulaciones (Lucio Anneo Seneca)»