CERT-In Vulnerability Note
CIVN-2010-0223
Microsoft SharePoint Cross Site Scripting (XSS) Vulnerabilities
Original Issue Date:October 15, 2010
Severity Rating: MEDIUM
Systems Affected
- Microsoft Office SharePoint Server 2007 Service Pack 2 (32-bit editions)
- Microsoft Office SharePoint Server 2007 Service Pack 2 (64-bit editions)
- Microsoft Windows SharePoint Services 3.0 Service Pack 2(32-bit versions)
- Microsoft Windows SharePoint Services 3.0 Service Pack 2(64-bit versions)
- Microsoft SharePoint Foundation 2010
- Microsoft Groove Server 2010
- Microsoft Office Web Apps
Overview
Multiple vulnerabilities exist in Microsoft SharePoint, which could be exploited by an attacker to perform cross site scripting attack, access to sensitive information or cause a denial of service.
Description
1. Microsoft SharePoint toStaticHTML API Information Disclosure Vulnerability
(
CVE-2010-3243
)
An information disclosure vulnerability exist in toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2 due to an error in the way "toStaticHTML" API sanitizes HTML on a SharePoint site. Successful exploitation of this vulnerability allows remote attacker to launch cross site scripting attacks.
2. Microsoft SharePoint toStaticHTML API Information Disclosure Vulnerability
(
CVE-2010-3324
)
An information disclosure vulnerability exist in toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010, Office SharePoint Server 2007 SP2, Groove Server 2010, and Office Web Apps, allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and conduct XSS attacks via a crafted use of the Cascading Style Sheets (CSS) @import rule. of this vulnerability allows remote attacker to cause a denial of service.
Workaround
- Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
- Read e-mails in plain text
- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
For detailed steps and the impact of the workarounds refer Microsoft Security Bulletin MS10-072
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
MS10-072
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/ms10-072.mspx
References
VUPEN
http://www.vupen.com/english/advisories/2010/2619
CISCO Security Intelligence
http://www.cisco.com/web/about/security/intelligence/ERP_oct10.html
http://tools.cisco.com/security/center/viewAlert.x?alertId=21503
http://tools.cisco.com/security/center/viewAlert.x?alertId=21504
SecurityTracker
http://securitytracker.com/alerts/2010/Oct/1024559.html
CVE Name
CVE-2010-3243
CVE-2010-3324
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|