CVE-2008-4033 Information

Description

Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0 as used in Microsoft Expression Web Office Internet Explorer and other products allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields as demonstrated by the Transfer-Encoding field aka \MSXML Header Request Vulnerability.\

Reference

http://marc.info/?l=bugtraq&m=122703006921213&w=2 http://securitytracker.com/id?1021164 http://www.securityfocus.com/bid/32204 http://www.us-cert.gov/cas/techalerts/TA08-316A.html http://www.vupen.com/english/advisories/2008/3111 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-069 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A5847