Vulnerability

CERT-In Vulnerability Note CIVN-2012-0101
Microsoft FAST Search Server Oracle Outside In Remote Code Execution Vulnerabilities

Original Issue Date:October 10, 2012

Severity Rating: HIGH

Systems Affected

Microsoft FAST Search Server 2010 for SharePoint Service Pack 1

Overview

A security vulnerability exists in Microsoft FAST Search Server 2010 using Advanced Filter pack that could allow arbitrary code to run when a maliciously modified file is opened.

Description

FAST Search Server builds on SharePoint Server 2010 uses deep linguistics and text analytics technology to add tags and structure to unstructured information and provides significant enhancements to the Enterprise Search capabilities. The Advanced Filter Pack feature in the FAST search server uses The Oracle Outside In libraries to support the text and metadata extraction of files in the backend server.

The security vulnerability exists in the Oracle Outside In Libraries when parsing specially crafted files. An attacker could exploit this by uploading a malicious file to a site using FAST Search to index, which could result in arbitrary code execution.

Note:

FAST Search Server for SharePoint is only affected by this issue when Advanced Filter Pack is enabled. By default, Advanced Filter Pack is disabled.
Microsoft licenses Oracle Outside In Libraries from Oracle.

Workaround

Disable the Advanced Filter Pack for FAST Search Server 2010 for SharePoint

Solution

Apply appropriate security updates as mentioned in Microsoft Security Bulletin MS12-067

Vendor Information

Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms12-067

References

Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms12-067
http://technet.microsoft.com/en-us/security/advisory/2737111
http://technet.microsoft.com/library/ff383314
http://technet.microsoft.com/en-us/sharepoint/ee441234.aspx

CERT-In
http://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2012-0032

CVE Name
CVE-2012-1766
CVE-2012-1767
CVE-2012-1768
CVE-2012-1769
CVE-2012-1770
CVE-2012-1771
CVE-2012-1772
CVE-2012-1773
CVE-2012-3106
CVE-2012-3107
CVE-2012-3108
CVE-2012-3109
CVE-2012-3110

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India