Key Details of Microsoft Windows 2000 Patch: Indexing Service Cross Site Scripting
- Windows 2000 Update
- Last updated on
- There have been 9 updates
- Virus scan status:
Clean (it’s extremely likely that this software program is clean)
Developer’s Description
Indexing Services is a search engine that is integrated with Internet Information Services (IIS) 5.0 and Windows 2000 that allows browsers to perform full-text searches of Web sites. Indexing Services does not properly validate all search inputs before processing them, and is consequently vulnerable to Cross-Site Scripting (CSS). CSS allows a malicious user to "inject" code into another person's Web session. If a malicious user is successful in exploiting this vulnerability, he or she can use a Web site hosted by your server to run code on a visting user's browser each time it returns to your Web site.
Note Indexing Services ships and installs with Windows 2000, but is not enabled by default. If you are running Web servers on Windows 2000 and you have enabled Indexing Services, Microsoft recommends that you apply this update.
For more information about this vulnerability, read Microsoft Security Bulletin MS00-084.
