Vulnerabilities > CVE-2010-1264 - Remote Denial of Service vulnerability in Microsoft Sharepoint Services 3.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
SINGLE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability."
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 4 |
Msbulletin
bulletin_id | MS10-039 |
bulletin_url | |
date | 2010-06-08T00:00:00 |
impact | Elevation of Privilege |
knowledgebase_id | 2028554 |
knowledgebase_url | |
severity | Important |
title | Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege |
Nessus
NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS10-039.NASL description The remote Windows host is running a version of InfoPath, SharePoint Server, or SharePoint Services with the following vulnerabilities : - A cross-site scripting vulnerability in Help.aspx. (CVE-2010-0817) - An information disclosure vulnerability in the toStaticHTML() API. (CVE-2010-1257) - A denial of service vulnerability, triggered by sending specially crafted requests to the help page. (CVE-2010-1264) last seen 2020-06-01 modified 2020-06-02 plugin id 46846 published 2010-06-09 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/46846 title MS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(46846); script_version("1.27"); script_cvs_date("Date: 2018/11/15 20:50:30"); script_cve_id("CVE-2010-0817", "CVE-2010-1257", "CVE-2010-1264"); script_bugtraq_id(39776, 40409, 40559); script_xref(name:"MSFT", value:"MS10-039"); script_xref(name:"IAVA", value:"2010-A-0079"); script_xref(name:"MSKB", value:"979441"); script_xref(name:"MSKB", value:"979445"); script_xref(name:"MSKB", value:"980923"); script_xref(name:"MSKB", value:"983444"); script_name(english:"MS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)"); script_summary(english:"Checks SharePoint / InfoPath version"); script_set_attribute(attribute:"synopsis", value:"The remote host has multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The remote Windows host is running a version of InfoPath, SharePoint Server, or SharePoint Services with the following vulnerabilities : - A cross-site scripting vulnerability in Help.aspx. (CVE-2010-0817) - An information disclosure vulnerability in the toStaticHTML() API. (CVE-2010-1257) - A denial of service vulnerability, triggered by sending specially crafted requests to the help page. (CVE-2010-1264)"); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-039"); script_set_attribute(attribute:"solution", value: "Microsoft has released a set of patches for InfoPath 2003, InfoPath 2007, SharePoint Server 2007, and SharePoint Services 3.0."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/04/28"); script_set_attribute(attribute:"patch_publication_date", value:"2010/06/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/09"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:infopath"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server"); script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_services"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows : Microsoft Bulletins"); script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc."); script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl"); script_require_keys("SMB/MS_Bulletin_Checks/Possible"); script_require_ports(139, 445, 'Host/patch_management_checks'); exit(0); } include("smb_func.inc"); include("smb_hotfixes.inc"); include("smb_hotfixes_fcheck.inc"); include("misc_func.inc"); include("audit.inc"); get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible"); bulletin = 'MS10-039'; kbs = make_list("979441", "979445", "980923", "983444"); if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING); # First get the version of SharePoint if (!get_kb_item("SMB/Registry/Enumerated")) exit(1, "The 'SMB/Registry/Enumerated' KB item is missing."); port = kb_smb_transport(); login = kb_smb_login(); pass = kb_smb_password(); domain = kb_smb_domain(); if(! smb_session_init()) audit(AUDIT_FN_FAIL, "smb_session_init"); rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$"); if (rc != 1) { NetUseDel(); audit(AUDIT_SHARE_FAIL, "IPC$"); } # Connect to remote registry. hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE); if (isnull(hklm)) { NetUseDel(); audit(AUDIT_REG_FAIL); } # Determine where it's installed. path = NULL; key = "SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0"; key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED); if (!isnull(key_h)) { value = RegQueryValue(handle:key_h, item:"Location"); if (!isnull(value)) path = value[1]; RegCloseKey(handle:key_h); } RegCloseKey(handle:hklm); NetUseDel (close:FALSE); kb = ''; sharepointserver_exe = NULL; if (path) { sharepointserver_exe = path + '\\Microsoft.Office.Server.Conversions.Launcher.exe'; share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:path); dll = ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1\BIN\Mssph.dll", string:path); r = NetUseAdd(share:share); if ( r != 1 ) { NetUseDel(); audit(AUDIT_SHARE_FAIL, share); } handle = CreateFile (file:dll, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING); if ( ! isnull(handle) ) { sharepoint_ver = GetFileVersion(handle:handle); CloseFile(handle:handle); } handle = CreateFile (file:sharepointserver_exe, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING); if ( ! isnull(handle) ) { kb = '979445'; CloseFile(handle:handle); } else kb = '983444'; } NetUseDel(); report = ""; vuln = FALSE; # The bulletin says: # # For supported editions of Microsoft Office SharePoint Server 2007, in # addition to security update package KB979445, customers also need to install # the security update for Microsoft Windows SharePoint Services 3.0 (KB982331) # to be protected from the vulnerabilities described in this bulletin. # # KB982331 addresses MS10-038, and is unrelated to SharePoint Services 3.0 - # it's for Excel. I'm going to assume that part of the sentence is # erroneous, and they mean KB983444. The SharePoint Server and SharePoint # Services KBs both update mssph.dll, and the SharePoint Services KB updates # it to a later version, so it looks like checking for that one file/version # will cover everything SharePoint-related in this bulletin # if (!isnull(sharepoint_ver)) { # Version 12.0.6529.5000 v = sharepoint_ver; if (v[0] == 12 && v[1] == 0 && (v[2] < 6529 || (v[2] == 6529 && v[3] < 5000))) { report += '\nProduct : SharePoint Server 2007 / SharePoint Services 3.0\n'+ 'Path : ' + path + "\bin\mssph.dll"+ '\n' + 'Installed version : ' + join(v, sep:'.') + '\n' + 'Fix : 12.0.6529.5000\n'; hotfix_add_report(report, bulletin:bulletin, kb:kb); vuln = TRUE; } } # Check InfoPath 2003 & 2007 report = ""; installs = get_kb_list("SMB/Office/InfoPath/*/ProductPath"); if (!isnull(installs)) { foreach install (keys(installs)) { infopath_ver = install - 'SMB/Office/InfoPath/' - '/ProductPath'; path = installs[install]; v = split(infopath_ver, sep:'.', keep:FALSE); for (i = 0; i < max_index(v); i++) v[i] = int(v[i]); if ( (v[0] == 11 && v[1] == 0 && v[2] < 8233) || (v[0] == 12 && v[1] == 0 && (v[2] < 6529 || (v[2] == 6529 && v[3] < 5000))) ) { if (v[0] == 11) { edition = '2003'; fix = '11.0.8233.0'; kb = '980923'; } else { edition = '2007'; fix = '12.0.6529.5000'; kb = '979441'; } report = '\nProduct : Microsoft Office InfoPath '+edition+'\n'+ 'Path : '+path+'\n'+ 'Installed version : '+infopath_ver+'\n' + 'Fix : '+fix+'\n'; hotfix_add_report(report, bulletin:bulletin, kb:kb); } } } if (vuln) { set_kb_item(name:'SMB/Missing/MS10-039', value:TRUE); set_kb_item(name: 'www/0/XSS', value: TRUE); hotfix_security_warning(); } else audit(AUDIT_HOST_NOT, 'affected');
NASL family CGI abuses NASL id SHAREPOINT_HELP_DOS.NASL description The version of Microsoft SharePoint Services running on the remote host has a denial of service vulnerability. Sending invalid data to the last seen 2020-06-01 modified 2020-06-02 plugin id 47579 published 2010-07-01 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/47579 title Microsoft SharePoint Service Help.aspx 'tid' Parameter DoS code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(47579); script_version("1.19"); script_cvs_date("Date: 2018/11/15 20:50:18"); script_cve_id("CVE-2010-1264"); script_bugtraq_id(40559); script_xref(name:"IAVA", value:"2010-A-0079"); script_xref(name:"MSFT", value:"MS10-039"); script_xref(name:"Secunia", value:"39603"); script_xref(name:"MSKB", value:"2328360"); script_xref(name:"MSKB", value:"2344911"); script_xref(name:"MSKB", value:"2344993"); script_xref(name:"MSKB", value:"2345000"); script_xref(name:"MSKB", value:"2345009"); script_xref(name:"MSKB", value:"2345043"); script_xref(name:"MSKB", value:"2346411"); script_name(english:"Microsoft SharePoint Service Help.aspx 'tid' Parameter DoS"); script_summary(english:"Attempts a temporary DoS attack"); script_set_attribute(attribute:"synopsis", value: "An application running on the remote web server has a denial of service vulnerability."); script_set_attribute(attribute:"description", value: "The version of Microsoft SharePoint Services running on the remote host has a denial of service vulnerability. Sending invalid data to the 'tid' parameter of 'help.aspx' can cause the application to hang. A remote attacker could exploit this by sending malicious requests, causing SharePoint to hang temporarily, resulting in a denial of service. Repeatedly sending malicious requests can cause SharePoint's application pool to stop, which would require a manual restart of the application pool."); script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-039"); script_set_attribute(attribute:"solution", value:"Microsoft has released a set of patches for SharePoint Services."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/06/08"); script_set_attribute(attribute:"patch_publication_date", value:"2010/06/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/07/01"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"stig_severity", value:"II"); script_end_attributes(); script_category(ACT_DENIAL); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc."); script_dependencies("http_version.nasl", "sharepoint_detect.nasl"); script_require_keys("www/ASP", "www/sharepoint", "Settings/ParanoidReport"); script_exclude_keys("Settings/disable_cgi_scanning"); script_require_ports("Services/www", 80); exit(0); } include("audit.inc"); include("global_settings.inc"); include("smb_func.inc"); include("misc_func.inc"); include("http.inc"); include("webapp_func.inc"); if ( get_kb_item("SMB/dont_send_in_cleartext" ) ) exit(0); if (report_paranoia < 2) exit(1, "This plugin only runs if 'Report paranoia' is set to 'Paranoid'."); port = get_http_port(default:80, asp:TRUE); install = get_install_from_kb(appname:'sharepoint', port:port, exit_on_fail:TRUE); function get_http_code() { local_var res, headers, http_code; res = _FCT_ANON_ARGS[0]; if (isnull(res)) return NULL; headers = parse_http_headers(status_line:res[0], headers:res[1]); if (isnull(headers)) exit(1, 'Error parsing HTTP headers on port '+port+'.'); http_code = headers['$code']; if (isnull(http_code)) exit(1, "Error parsing HTTP response code"); return http_code; } url = install['dir']+'/_layouts/help.aspx'; dos_qs = '?tid=1&'+SCRIPT_NAME+'='+unixtime(); vuln = FALSE; # First, make sure the page is accessible res = http_send_recv3( method:'GET', item:url, port:port, username:kb_smb_login(), password:kb_smb_password(), exit_on_fail:TRUE ); code = get_http_code(res); if (code == 401) exit(1, 'Authentication failed on port '+port+'.'); if ('<title>Help</title>' >!< res[2] || '<br/>Cannot display help.<br/>' >!< res[2]) exit(1, 'Error retrieving '+build_url(qs:url,port:port)); # Next, attempt to trigger the DoS res = http_send_recv3( method:'GET', item:url+dos_qs, port:port, username:kb_smb_login(), password:kb_smb_password() ); # Check if there is a timeout. Otherwise, check for a HTTP 503 # (which likely means the application pool has stopped) if (isnull(res)) vuln = TRUE; else { code = get_http_code(res); if (code == 503 && res[2] == '<h1>Service Unavailable</h1>') vuln = TRUE; } if (vuln) { if (report_verbosity > 0) { report = get_vuln_report(items:url+dos_qs, port:port); security_warning(port:port, extra:report); } else security_warning(port); } else exit(0, 'SharePoint Services on port '+port+' is not affected.');
Oval
accepted | 2013-11-11T04:02:58.962-05:00 | ||||||||||||
class | vulnerability | ||||||||||||
contributors |
| ||||||||||||
definition_extensions |
| ||||||||||||
description | Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability." | ||||||||||||
family | windows | ||||||||||||
id | oval:org.mitre.oval:def:7241 | ||||||||||||
status | accepted | ||||||||||||
submitted | 2010-06-08T13:00:00 | ||||||||||||
title | Sharepoint Help Page Denial of Service Vulnerability | ||||||||||||
version | 27 |