Microsoft Indexing Services for Windows 2000 File Verification Vulnerability

Microsoft Windows 2000 Indexing Services is a search engine that will allow a user to perform full-text searches of online sites using their browsers. Search results include Word, Excel, PowerPoint, and HTML documents. By default, this service is not enabled in Windows 2000.

A malicious website operator may verify the existence of files residing on a Windows 2000 system with Indexing Services enabled. The website operator is capable of searching for specific files by using the Indexing Services via specially malformed HTML containing the ActiveX Object 'ixsso.query'. Query results will display the full physical path of the file and will only be retrieved from directories that have been explicitly configured as searchable directories within the Indexing Service.

Successful disclosure of a file's availability may aid in more severe attacks against the target system.


Privacy Statement
Copyright 2010, SecurityFocus