Multiple vulnerabilities in Microsoft SharePoint
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2010-1264 CVE-2010-1257 CVE-2010-0817 |
| CWE-ID | CWE-20 CWE-79 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #1 is available. Vulnerability #3 is being exploited in the wild. |
| Vulnerable software |
Microsoft Windows SharePoint Services Web applications / Other software Microsoft Office InfoPath Client/Desktop applications / Office applications Microsoft SharePoint Server Server applications / Application servers |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Denial of service
EUVDB-ID: #VU3050
Risk: Medium
CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C]
CVE-ID: CVE-2010-1264
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause denial of service condition.
The vulnerability exists due to an error in Microsoft SharePoint when processing specially crafted requests to the help page. A remote attacker can send a specially crafted HTTP request and cause the application to stop responding.
Successful exploitation of the vulnerability will allow and attacker to cause the web server to become non-responsive until the associated application pool is restarted.
MitigationInstall update from vendor's website:
Microsoft Windows SharePoint Services 3.0 Service Pack 1 and Microsoft Windows SharePoint Services 3.0 Service Pack 2 (32-bit versions)
https://www.microsoft.com/downloads/details.aspx?familyid=3841ceda-d0af-4e5e-8a1a-7dd954850783
Microsoft Windows SharePoint Services 3.0 Service Pack 1 and Microsoft Windows SharePoint Services 3.0 Service Pack 2 (64-bit versions)
https://www.microsoft.com/downloads/details.aspx?familyid=94bc76d4-78e4-4bda-8922-36c3a9d3854f
Microsoft Windows SharePoint Services: 3.0 SP1
CPE2.3 External linkshttp://technet.microsoft.com/en-us/library/security/ms10-039.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
2) Cross-site scripting
EUVDB-ID: #VU3049
Risk: Low
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2010-1257
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to insufficient sanitization of user-supplied input data within SharePoint toStaticHTML API. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in victim’s browser in context of vulnerable SharePoint website.
Successful exploitation may allow an attacker to conduct phishing and drive-by-download attacks and obtain potentially sensitive information.
MitigationInstall updates from vendor's website:
Microsoft Office InfoPath 2003 Service Pack 3
https://www.microsoft.com/downloads/details.aspx?familyid=4f79d376-0ea2-4218-9200-3c34c83ba336
Microsoft Office InfoPath 2007 Service Pack 1 and Microsoft Office InfoPath 2007 Service Pack 2
https://www.microsoft.com/downloads/details.aspx?familyid=bfa8765a-7970-4feb-996c-7c27d71c97c6
Microsoft Office SharePoint Server 2007 Service Pack 1 and Microsoft Office SharePoint Server 2007 Service Pack 2 (32-bit editions)
https://www.microsoft.com/downloads/details.aspx?familyid=52a55423-f33b-4cd1-919d-806972a553df
Microsoft Office SharePoint Server 2007 Service Pack 1 and Microsoft Office SharePoint Server 2007 Service Pack 2 (64-bit editions)
https://www.microsoft.com/downloads/details.aspx?familyid=52a55423-f33b-4cd1-919d-806972a553df
Microsoft Windows SharePoint Services 3.0 Service Pack 1 and Microsoft Windows SharePoint Services 3.0 Service Pack 2 (32-bit versions)
https://www.microsoft.com/downloads/details.aspx?familyid=3841ceda-d0af-4e5e-8a1a-7dd954850783
Microsoft Windows SharePoint Services 3.0 Service Pack 1 and Microsoft Windows SharePoint Services 3.0 Service Pack 2 (64-bit versions)
https://www.microsoft.com/downloads/details.aspx?familyid=94bc76d4-78e4-4bda-8922-36c3a9d3854f
Microsoft Windows SharePoint Services: 3.0 SP1
Microsoft Office InfoPath: 2003 - 2007
Microsoft SharePoint Server: 2007
CPE2.3- cpe:2.3:a:microsoft:microsoft_windows_sharepoint_services:3.0 SP1:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_office_infopath:2003:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_office_infopath:2007:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_sharepoint_server:2007:*:*:*:*:*:*:
http://technet.microsoft.com/en-us/library/security/ms10-039.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Cross-site scripting
EUVDB-ID: #VU3048
Risk: Medium
CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C]
CVE-ID: CVE-2010-0817
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to insufficient sanitization of user-supplied input data passed to Help.aspx script. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in victim’s browser in context of vulnerable SharePoint website.
Successful exploitation may allow an attacker to conduct phishing and drive-by-download attacks.
Note: this vulnerability is being publicly exploited.
MitigationInstall update from vendor's website:
Microsoft Windows SharePoint Services 3.0 Service Pack 1 and Microsoft Windows SharePoint Services 3.0 Service Pack 2 (32-bit versions)
https://www.microsoft.com/downloads/details.aspx?familyid=3841ceda-d0af-4e5e-8a1a-7dd954850783
Microsoft Windows SharePoint Services 3.0 Service Pack 1 and Microsoft Windows SharePoint Services 3.0 Service Pack 2 (64-bit versions)
https://www.microsoft.com/downloads/details.aspx?familyid=94bc76d4-78e4-4bda-8922-36c3a9d3854f
Microsoft Windows SharePoint Services: 3.0 SP1
Microsoft Office InfoPath: 2003 - 2007
Microsoft SharePoint Server: 2007
CPE2.3- cpe:2.3:a:microsoft:microsoft_windows_sharepoint_services:3.0 SP1:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_office_infopath:2003:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_office_infopath:2007:*:*:*:*:*:*:
- cpe:2.3:a:microsoft:microsoft_sharepoint_server:2007:*:*:*:*:*:*:
http://technet.microsoft.com/en-us/library/security/ms10-039.aspx
http://www.htbridge.com/advisory/HTB22350
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
