Vulnerabilities > CVE-2010-1257 - Cross-site Scripting vulnerability in Microsoft products

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Embedding Scripts in Non-Script Elements
    This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Cross-Site Scripting in Error Pages
    An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
  • Cross-Site Scripting Using Alternate Syntax
    The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Msbulletin

  • bulletin_idMS10-039
    bulletin_url
    date2010-06-08T00:00:00
    impactElevation of Privilege
    knowledgebase_id2028554
    knowledgebase_url
    severityImportant
    titleVulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege
  • bulletin_idMS10-035
    bulletin_url
    date2010-06-08T00:00:00
    impactRemote Code Execution
    knowledgebase_id982381
    knowledgebase_url
    severityCritical
    titleCumulative Security Update for Internet Explorer

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS10-035.NASL
    descriptionThe remote host is missing IE Security Update 982381. The remote version of IE is affected by several vulnerabilities that may allow an attacker to execute arbitrary code on the remote host.
    last seen2020-06-01
    modified2020-06-02
    plugin id46842
    published2010-06-09
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/46842
    titleMS10-035: Cumulative Security Update for Internet Explorer (982381)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(46842);
      script_version("1.27");
      script_cvs_date("Date: 2018/11/15 20:50:30");
    
      script_cve_id("CVE-2010-0255", "CVE-2010-1257", "CVE-2010-1259",
                    "CVE-2010-1260", "CVE-2010-1261", "CVE-2010-1262");
      script_bugtraq_id(38055, 38056, 40410, 40414, 40416, 40417);
      script_xref(name:"MSFT", value:"MS10-035");
      script_xref(name:"MSKB", value:"982381");
    
      script_name(english:"MS10-035: Cumulative Security Update for Internet Explorer (982381)");
      script_summary(english:"Checks version of Mshtml.dll / MSrating.dll");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "Arbitrary code can be executed on the remote host through a web
    browser."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "The remote host is missing IE Security Update 982381.
    
    The remote version of IE is affected by several vulnerabilities that
    may allow an attacker to execute arbitrary code on the remote host."
      );
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-035");
      script_set_attribute(
        attribute:"solution",
        value:
    "Microsoft has released a set of patches for Windows 2000, XP, 2003,
    Vista, 2008, 7, and 2008 R2.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(264);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/02/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/06/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:microsoft:windows");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, 'Host/patch_management_checks');
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS10-035';
    kbs = make_list("982381");
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win2k:'4,5', xp:'2,3', win2003:'2', vista:'1,2', win7:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);
    
    rootfile = hotfix_get_systemroot();
    if (!rootfile) exit(1, "Failed to get the system root.");
    
    share = hotfix_path2share(path:rootfile);
    if (!is_accessible_share(share:share)) audit(AUDIT_SHARE_FAIL, share);
    
    kb = '982381';
    if (
      # Windows 7 and Windows Server 2008 R2
      #
      # - Internet Explorer 8
      hotfix_is_vulnerable(os:"6.1",       file:"Mshtml.dll", version:"8.0.7600.20708", min_version:"8.0.7600.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"6.1",       file:"Mshtml.dll", version:"8.0.7600.16588", min_version:"8.0.7600.16000", dir:"\system32", bulletin:bulletin, kb:kb) ||
    
      # Vista / Windows 2008
      #
      # - Internet Explorer 8
      hotfix_is_vulnerable(os:"6.0",       file:"Mshtml.dll", version:"8.0.6001.23019", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"6.0",       file:"Mshtml.dll", version:"8.0.6001.18928", min_version:"8.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      # - Internet Explorer 7
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.22398", min_version:"7.0.6002.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"6.0", sp:2, file:"Mshtml.dll", version:"7.0.6002.18255", min_version:"7.0.6002.18000",  dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.22685", min_version:"7.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"6.0", sp:1, file:"Mshtml.dll", version:"7.0.6001.18470", min_version:"7.0.6001.18000", dir:"\system32", bulletin:bulletin, kb:kb) ||
    
      # Windows 2003 / XP x64
      #
      # - Internet Explorer 8
      hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"8.0.6001.23019", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"8.0.6001.18928", min_version:"8.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
      # - Internet Explorer 7
      hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.21264", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"7.0.6000.17063", min_version:"7.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
       # - Internet Explorer 6
      hotfix_is_vulnerable(os:"5.2", sp:2, file:"Mshtml.dll", version:"6.0.3790.4696",  min_version:"6.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
    
      # Windows XP x86
      #
      # - Internet Explorer 8
      hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.23019", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.18928", min_version:"8.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.23019", min_version:"8.0.6001.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"8.0.6001.18928", min_version:"8.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
      # - Internet Explorer 7
      hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.21264", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.17063", min_version:"7.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.21264", min_version:"7.0.6000.20000", dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"7.0.6000.17063", min_version:"7.0.0.0",        dir:"\system32", bulletin:bulletin, kb:kb) ||
      # - Internet Explorer 6 SP1
      hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Msrating.dll", version:"6.0.2900.3698",  min_version:"6.0.0.0",      dir:"\system32", bulletin:bulletin, kb:kb) ||
      # - Internet Explorer 6
      hotfix_is_vulnerable(os:"5.1", sp:3, arch:"x86", file:"Mshtml.dll", version:"6.0.2900.5969",  min_version:"6.0.2900.0",     dir:"\system32", bulletin:bulletin, kb:kb) ||
      hotfix_is_vulnerable(os:"5.1", sp:2, arch:"x86", file:"Mshtml.dll", version:"6.0.2900.3698",  min_version:"6.0.2900.0",     dir:"\system32", bulletin:bulletin, kb:kb) ||
    
      # Windows 2000
      #
      # - Internet Explorer 6 w/ Service Pack 1
      hotfix_is_vulnerable(os:"5.0", file:"Msrating.dll", version:"6.0.2800.2006", min_version:"6.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb) ||
      # - Internet Explorer 5.01 w/ Service Pack 4
      hotfix_is_vulnerable(os:"5.0", file:"Mshtml.dll",   version:"5.0.3888.1400",  min_version:"5.0.0.0", dir:"\system32", bulletin:bulletin, kb:kb)
    )
    {
      set_kb_item(name:"SMB/Missing/MS10-035", value:TRUE);
      hotfix_security_hole();
      hotfix_check_fversion_end();
      exit(0);
    }
    else
    {
      hotfix_check_fversion_end();
      audit(AUDIT_HOST_NOT, 'affected');
    }
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS10-039.NASL
    descriptionThe remote Windows host is running a version of InfoPath, SharePoint Server, or SharePoint Services with the following vulnerabilities : - A cross-site scripting vulnerability in Help.aspx. (CVE-2010-0817) - An information disclosure vulnerability in the toStaticHTML() API. (CVE-2010-1257) - A denial of service vulnerability, triggered by sending specially crafted requests to the help page. (CVE-2010-1264)
    last seen2020-06-01
    modified2020-06-02
    plugin id46846
    published2010-06-09
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/46846
    titleMS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(46846);
      script_version("1.27");
      script_cvs_date("Date: 2018/11/15 20:50:30");
    
      script_cve_id("CVE-2010-0817", "CVE-2010-1257", "CVE-2010-1264");
      script_bugtraq_id(39776, 40409, 40559);
      script_xref(name:"MSFT", value:"MS10-039");
      script_xref(name:"IAVA", value:"2010-A-0079");
      script_xref(name:"MSKB", value:"979441");
      script_xref(name:"MSKB", value:"979445");
      script_xref(name:"MSKB", value:"980923");
      script_xref(name:"MSKB", value:"983444");
    
      script_name(english:"MS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)");
      script_summary(english:"Checks SharePoint / InfoPath version");
    
      script_set_attribute(attribute:"synopsis", value:"The remote host has multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is running a version of InfoPath, SharePoint
    Server, or SharePoint Services with the following vulnerabilities :
    
      - A cross-site scripting vulnerability in Help.aspx.
        (CVE-2010-0817)
    
      - An information disclosure vulnerability in the
        toStaticHTML() API. (CVE-2010-1257)
    
      - A denial of service vulnerability, triggered by sending
        specially crafted requests to the help page.
        (CVE-2010-1264)");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-039");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for InfoPath 2003, InfoPath
    2007, SharePoint Server 2007, and SharePoint Services 3.0.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/04/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/06/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:infopath");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_services");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, 'Host/patch_management_checks');
    
      exit(0);
    }
    
    
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    include("audit.inc");
    
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS10-039';
    kbs = make_list("979441", "979445", "980923", "983444");
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);
    
    
    # First get the version of SharePoint
    if (!get_kb_item("SMB/Registry/Enumerated"))
      exit(1, "The 'SMB/Registry/Enumerated' KB item is missing.");
    
    port    =  kb_smb_transport();
    login   =  kb_smb_login();
    pass    =  kb_smb_password();
    domain  =  kb_smb_domain();
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, "smb_session_init");
    
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
    if (rc != 1)
    {
      NetUseDel();
      audit(AUDIT_SHARE_FAIL, "IPC$");
    }
    
    
    # Connect to remote registry.
    hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
    if (isnull(hklm))
    {
      NetUseDel();
      audit(AUDIT_REG_FAIL);
    }
    
    # Determine where it's installed.
    path = NULL;
    
    key = "SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0";
    key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
    
    if (!isnull(key_h))
    {
     value = RegQueryValue(handle:key_h, item:"Location");
     if (!isnull(value))
       path = value[1];
    
     RegCloseKey(handle:key_h);
    }
    
    RegCloseKey(handle:hklm);
    NetUseDel (close:FALSE);
    
    
    kb = '';
    sharepointserver_exe = NULL;
    if (path)
    {
      sharepointserver_exe = path + '\\Microsoft.Office.Server.Conversions.Launcher.exe';
      share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:path);
      dll =  ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1\BIN\Mssph.dll", string:path);
    
      r = NetUseAdd(share:share);
      if ( r != 1 )
      {
        NetUseDel();
        audit(AUDIT_SHARE_FAIL, share);
      }
    
      handle = CreateFile (file:dll, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING);
      if ( ! isnull(handle) )
      {
        sharepoint_ver = GetFileVersion(handle:handle);
        CloseFile(handle:handle);
      }
      handle = CreateFile (file:sharepointserver_exe, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING);
      if ( ! isnull(handle) )
      {
        kb = '979445';
        CloseFile(handle:handle);
      }
      else kb = '983444';
    }
    NetUseDel();
    
    report = "";
    vuln = FALSE;
    
    # The bulletin says:
    #
    #   For supported editions of Microsoft Office SharePoint Server 2007, in
    #   addition to security update package KB979445, customers also need to install
    #   the security update for Microsoft Windows SharePoint Services 3.0 (KB982331)
    #   to be protected from the vulnerabilities described in this bulletin.
    #
    # KB982331 addresses MS10-038, and is unrelated to SharePoint Services 3.0 -
    # it's for Excel.  I'm going to assume that part of the sentence is
    # erroneous, and they mean KB983444.  The SharePoint Server and SharePoint
    # Services KBs both update mssph.dll, and the SharePoint Services KB updates
    # it to a later version, so it looks like checking for that one file/version
    # will cover everything SharePoint-related in this bulletin
    #
    if (!isnull(sharepoint_ver))
    {
      # Version 12.0.6529.5000
      v = sharepoint_ver;
      if (v[0] == 12 && v[1] == 0 && (v[2] < 6529 || (v[2] == 6529 && v[3] < 5000)))
      {
        report +=
          '\nProduct         : SharePoint Server 2007 / SharePoint Services 3.0\n'+
          'Path              : ' + path + "\bin\mssph.dll"+ '\n' +
          'Installed version : ' + join(v, sep:'.') + '\n' +
          'Fix               : 12.0.6529.5000\n';
        hotfix_add_report(report, bulletin:bulletin, kb:kb);
        vuln = TRUE;
      }
    }
    
    # Check InfoPath 2003 & 2007
    report = "";
    installs = get_kb_list("SMB/Office/InfoPath/*/ProductPath");
    if (!isnull(installs))
    {
      foreach install (keys(installs))
      {
        infopath_ver = install - 'SMB/Office/InfoPath/' - '/ProductPath';
        path = installs[install];
    
        v = split(infopath_ver, sep:'.', keep:FALSE);
        for (i = 0; i < max_index(v); i++)
          v[i] = int(v[i]);
    
        if (
          (v[0] == 11 && v[1] == 0 && v[2] < 8233) ||
          (v[0] == 12 && v[1] == 0 && (v[2] < 6529 || (v[2] == 6529 && v[3] < 5000)))
        )
        {
          if (v[0] == 11)
          {
            edition = '2003';
            fix = '11.0.8233.0';
            kb = '980923';
          }
          else
          {
            edition = '2007';
            fix = '12.0.6529.5000';
            kb = '979441';
          }
          report =
            '\nProduct          : Microsoft Office InfoPath '+edition+'\n'+
            'Path              : '+path+'\n'+
            'Installed version : '+infopath_ver+'\n' +
            'Fix               : '+fix+'\n';
          hotfix_add_report(report, bulletin:bulletin, kb:kb);
        }
      }
    }
    
    if (vuln)
    {
      set_kb_item(name:'SMB/Missing/MS10-039', value:TRUE);
      set_kb_item(name: 'www/0/XSS', value: TRUE);
    
      hotfix_security_warning();
    }
    else audit(AUDIT_HOST_NOT, 'affected');
    

Oval

accepted2014-08-18T04:06:16.837-04:00
classvulnerability
contributors
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameRachana Shetty
    organizationSecPod Technologies
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameJosh Turpin
    organizationSymantec Corporation
  • nameDragos Prisaca
    organizationG2, Inc.
  • nameDragos Prisaca
    organizationG2, Inc.
  • nameChandan S
    organizationSecPod Technologies
  • nameMaria Mikhno
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
definition_extensions
  • commentMicrosoft Windows XP (32-bit) is installed
    ovaloval:org.mitre.oval:def:1353
  • commentMicrosoft Windows XP x64 is installed
    ovaloval:org.mitre.oval:def:15247
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Internet Explorer 8 is installed
    ovaloval:org.mitre.oval:def:6210
  • commentMicrosoft Windows XP (32-bit) is installed
    ovaloval:org.mitre.oval:def:1353
  • commentMicrosoft Windows XP x64 is installed
    ovaloval:org.mitre.oval:def:15247
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
  • commentMicrosoft Internet Explorer 8 is installed
    ovaloval:org.mitre.oval:def:6210
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Internet Explorer 8 is installed
    ovaloval:org.mitre.oval:def:6210
  • commentMicrosoft Windows Vista (32-bit) is installed
    ovaloval:org.mitre.oval:def:1282
  • commentMicrosoft Windows Vista x64 Edition is installed
    ovaloval:org.mitre.oval:def:2041
  • commentMicrosoft Windows Server 2008 (32-bit) is installed
    ovaloval:org.mitre.oval:def:4870
  • commentMicrosoft Windows Server 2008 (64-bit) is installed
    ovaloval:org.mitre.oval:def:5356
  • commentMicrosoft Internet Explorer 8 is installed
    ovaloval:org.mitre.oval:def:6210
  • commentMicrosoft Windows 7 (32-bit) is installed
    ovaloval:org.mitre.oval:def:6165
  • commentMicrosoft Windows 7 x64 Edition is installed
    ovaloval:org.mitre.oval:def:5950
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
    ovaloval:org.mitre.oval:def:5954
  • commentMicrosoft Internet Explorer 8 is installed
    ovaloval:org.mitre.oval:def:6210
  • commentMicrosoft Windows 7 (32-bit) is installed
    ovaloval:org.mitre.oval:def:6165
  • commentMicrosoft Windows 7 x64 Edition is installed
    ovaloval:org.mitre.oval:def:5950
  • commentMicrosoft Windows Server 2008 R2 x64 Edition is installed
    ovaloval:org.mitre.oval:def:6438
  • commentMicrosoft Windows Server 2008 R2 Itanium-Based Edition is installed
    ovaloval:org.mitre.oval:def:5954
  • commentMicrosoft Internet Explorer 8 is installed
    ovaloval:org.mitre.oval:def:6210
  • commentMicrosoft InfoPath 2003 is installed
    ovaloval:org.mitre.oval:def:7304
  • commentMicrosoft InfoPath 2007 is installed
    ovaloval:org.mitre.oval:def:7345
  • commentMicrosoft Office SharePoint Server 2007 is installed.
    ovaloval:org.mitre.oval:def:2313
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
descriptionCross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
familywindows
idoval:org.mitre.oval:def:6677
statusaccepted
submitted2010-06-08T13:00:00
titletoStaticHTML Information Disclosure Vulnerability
version97

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 40409 CVE ID: CVE-2010-1257 Internet Explorer是Windows操作系统中默认捆绑的web浏览器。 Internet Explorer在过滤HTML时处理使用特定字符串的内容的方式存在信息泄露漏洞。攻击者可以通过创建特制的网页来利用这个漏洞,如果用户查看了该网页就会导致信息泄露。成功利用这个漏洞的攻击者可以对用户执行跨站脚本,允许攻击者在用户的安全环境中对使用toStaticHTML API的站点执行脚本。 这个漏洞仅影响Internet Explorer 8中的Quirk渲染模式。 Microsoft Internet Explorer 8.0 临时解决方法: * 将Internet Explorer配置为在Internet和本地Intranet安全区域中运行ActiveX控件和活动脚本之前进行提示。 * 将Internet和本地Intranet安全区域设置设为“高”,以便在这些区域中运行ActiveX控件和活动脚本之前进行提示。 厂商补丁: Microsoft --------- Microsoft已经为此发布了一个安全公告(MS10-035)以及相应补丁: MS10-035:Cumulative Security Update for Internet Explorer (982381) 链接:http://www.microsoft.com/technet/security/bulletin/MS10-035.mspx?pf=true
idSSV:19782
last seen2017-11-19
modified2010-06-10
published2010-06-10
reporterRoot
titleMicrosoft IE toStaticHTML跨域信息泄露漏洞(MS10-035)