Vulnerabilities > CVE-2010-1264 - Remote Denial of Service vulnerability in Microsoft Sharepoint Services 3.0

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
microsoft
nessus

Summary

Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability."

Vulnerable Configurations

Part Description Count
Application
Microsoft
4

Msbulletin

bulletin_idMS10-039
bulletin_url
date2010-06-08T00:00:00
impactElevation of Privilege
knowledgebase_id2028554
knowledgebase_url
severityImportant
titleVulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS10-039.NASL
    descriptionThe remote Windows host is running a version of InfoPath, SharePoint Server, or SharePoint Services with the following vulnerabilities : - A cross-site scripting vulnerability in Help.aspx. (CVE-2010-0817) - An information disclosure vulnerability in the toStaticHTML() API. (CVE-2010-1257) - A denial of service vulnerability, triggered by sending specially crafted requests to the help page. (CVE-2010-1264)
    last seen2020-06-01
    modified2020-06-02
    plugin id46846
    published2010-06-09
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/46846
    titleMS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(46846);
      script_version("1.27");
      script_cvs_date("Date: 2018/11/15 20:50:30");
    
      script_cve_id("CVE-2010-0817", "CVE-2010-1257", "CVE-2010-1264");
      script_bugtraq_id(39776, 40409, 40559);
      script_xref(name:"MSFT", value:"MS10-039");
      script_xref(name:"IAVA", value:"2010-A-0079");
      script_xref(name:"MSKB", value:"979441");
      script_xref(name:"MSKB", value:"979445");
      script_xref(name:"MSKB", value:"980923");
      script_xref(name:"MSKB", value:"983444");
    
      script_name(english:"MS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)");
      script_summary(english:"Checks SharePoint / InfoPath version");
    
      script_set_attribute(attribute:"synopsis", value:"The remote host has multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is running a version of InfoPath, SharePoint
    Server, or SharePoint Services with the following vulnerabilities :
    
      - A cross-site scripting vulnerability in Help.aspx.
        (CVE-2010-0817)
    
      - An information disclosure vulnerability in the
        toStaticHTML() API. (CVE-2010-1257)
    
      - A denial of service vulnerability, triggered by sending
        specially crafted requests to the help page.
        (CVE-2010-1264)");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-039");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for InfoPath 2003, InfoPath
    2007, SharePoint Server 2007, and SharePoint Services 3.0.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/04/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/06/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/06/09");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:office");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:infopath");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_server");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:sharepoint_services");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_nt_ms02-031.nasl", "office_installed.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, 'Host/patch_management_checks');
    
      exit(0);
    }
    
    
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("misc_func.inc");
    include("audit.inc");
    
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = 'MS10-039';
    kbs = make_list("979441", "979445", "980923", "983444");
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_WARNING);
    
    
    # First get the version of SharePoint
    if (!get_kb_item("SMB/Registry/Enumerated"))
      exit(1, "The 'SMB/Registry/Enumerated' KB item is missing.");
    
    port    =  kb_smb_transport();
    login   =  kb_smb_login();
    pass    =  kb_smb_password();
    domain  =  kb_smb_domain();
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, "smb_session_init");
    
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
    if (rc != 1)
    {
      NetUseDel();
      audit(AUDIT_SHARE_FAIL, "IPC$");
    }
    
    
    # Connect to remote registry.
    hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
    if (isnull(hklm))
    {
      NetUseDel();
      audit(AUDIT_REG_FAIL);
    }
    
    # Determine where it's installed.
    path = NULL;
    
    key = "SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\12.0";
    key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
    
    if (!isnull(key_h))
    {
     value = RegQueryValue(handle:key_h, item:"Location");
     if (!isnull(value))
       path = value[1];
    
     RegCloseKey(handle:key_h);
    }
    
    RegCloseKey(handle:hklm);
    NetUseDel (close:FALSE);
    
    
    kb = '';
    sharepointserver_exe = NULL;
    if (path)
    {
      sharepointserver_exe = path + '\\Microsoft.Office.Server.Conversions.Launcher.exe';
      share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:path);
      dll =  ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1\BIN\Mssph.dll", string:path);
    
      r = NetUseAdd(share:share);
      if ( r != 1 )
      {
        NetUseDel();
        audit(AUDIT_SHARE_FAIL, share);
      }
    
      handle = CreateFile (file:dll, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING);
      if ( ! isnull(handle) )
      {
        sharepoint_ver = GetFileVersion(handle:handle);
        CloseFile(handle:handle);
      }
      handle = CreateFile (file:sharepointserver_exe, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING);
      if ( ! isnull(handle) )
      {
        kb = '979445';
        CloseFile(handle:handle);
      }
      else kb = '983444';
    }
    NetUseDel();
    
    report = "";
    vuln = FALSE;
    
    # The bulletin says:
    #
    #   For supported editions of Microsoft Office SharePoint Server 2007, in
    #   addition to security update package KB979445, customers also need to install
    #   the security update for Microsoft Windows SharePoint Services 3.0 (KB982331)
    #   to be protected from the vulnerabilities described in this bulletin.
    #
    # KB982331 addresses MS10-038, and is unrelated to SharePoint Services 3.0 -
    # it's for Excel.  I'm going to assume that part of the sentence is
    # erroneous, and they mean KB983444.  The SharePoint Server and SharePoint
    # Services KBs both update mssph.dll, and the SharePoint Services KB updates
    # it to a later version, so it looks like checking for that one file/version
    # will cover everything SharePoint-related in this bulletin
    #
    if (!isnull(sharepoint_ver))
    {
      # Version 12.0.6529.5000
      v = sharepoint_ver;
      if (v[0] == 12 && v[1] == 0 && (v[2] < 6529 || (v[2] == 6529 && v[3] < 5000)))
      {
        report +=
          '\nProduct         : SharePoint Server 2007 / SharePoint Services 3.0\n'+
          'Path              : ' + path + "\bin\mssph.dll"+ '\n' +
          'Installed version : ' + join(v, sep:'.') + '\n' +
          'Fix               : 12.0.6529.5000\n';
        hotfix_add_report(report, bulletin:bulletin, kb:kb);
        vuln = TRUE;
      }
    }
    
    # Check InfoPath 2003 & 2007
    report = "";
    installs = get_kb_list("SMB/Office/InfoPath/*/ProductPath");
    if (!isnull(installs))
    {
      foreach install (keys(installs))
      {
        infopath_ver = install - 'SMB/Office/InfoPath/' - '/ProductPath';
        path = installs[install];
    
        v = split(infopath_ver, sep:'.', keep:FALSE);
        for (i = 0; i < max_index(v); i++)
          v[i] = int(v[i]);
    
        if (
          (v[0] == 11 && v[1] == 0 && v[2] < 8233) ||
          (v[0] == 12 && v[1] == 0 && (v[2] < 6529 || (v[2] == 6529 && v[3] < 5000)))
        )
        {
          if (v[0] == 11)
          {
            edition = '2003';
            fix = '11.0.8233.0';
            kb = '980923';
          }
          else
          {
            edition = '2007';
            fix = '12.0.6529.5000';
            kb = '979441';
          }
          report =
            '\nProduct          : Microsoft Office InfoPath '+edition+'\n'+
            'Path              : '+path+'\n'+
            'Installed version : '+infopath_ver+'\n' +
            'Fix               : '+fix+'\n';
          hotfix_add_report(report, bulletin:bulletin, kb:kb);
        }
      }
    }
    
    if (vuln)
    {
      set_kb_item(name:'SMB/Missing/MS10-039', value:TRUE);
      set_kb_item(name: 'www/0/XSS', value: TRUE);
    
      hotfix_security_warning();
    }
    else audit(AUDIT_HOST_NOT, 'affected');
    
  • NASL familyCGI abuses
    NASL idSHAREPOINT_HELP_DOS.NASL
    descriptionThe version of Microsoft SharePoint Services running on the remote host has a denial of service vulnerability. Sending invalid data to the
    last seen2020-06-01
    modified2020-06-02
    plugin id47579
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/47579
    titleMicrosoft SharePoint Service Help.aspx 'tid' Parameter DoS
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(47579);
      script_version("1.19");
      script_cvs_date("Date: 2018/11/15 20:50:18");
    
      script_cve_id("CVE-2010-1264");
      script_bugtraq_id(40559);
      script_xref(name:"IAVA", value:"2010-A-0079");
      script_xref(name:"MSFT", value:"MS10-039");
      script_xref(name:"Secunia", value:"39603");
      script_xref(name:"MSKB", value:"2328360");
      script_xref(name:"MSKB", value:"2344911");
      script_xref(name:"MSKB", value:"2344993");
      script_xref(name:"MSKB", value:"2345000");
      script_xref(name:"MSKB", value:"2345009");
      script_xref(name:"MSKB", value:"2345043");
      script_xref(name:"MSKB", value:"2346411");
    
      script_name(english:"Microsoft SharePoint Service Help.aspx 'tid' Parameter DoS");
      script_summary(english:"Attempts a temporary DoS attack");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application running on the remote web server has a denial of
    service vulnerability.");
      script_set_attribute(attribute:"description", value:
    "The version of Microsoft SharePoint Services running on the remote
    host has a denial of service vulnerability. Sending invalid data to
    the 'tid' parameter of 'help.aspx' can cause the application to hang.
    
    A remote attacker could exploit this by sending malicious requests,
    causing SharePoint to hang temporarily, resulting in a denial of
    service. Repeatedly sending malicious requests can cause SharePoint's
    application pool to stop, which would require a manual restart of the
    application pool.");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-039");
      script_set_attribute(attribute:"solution", value:"Microsoft has released a set of patches for SharePoint Services.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/06/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/06/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/07/01");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"stig_severity", value:"II");
      script_end_attributes();
    
      script_category(ACT_DENIAL);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");
    
      script_dependencies("http_version.nasl", "sharepoint_detect.nasl");
      script_require_keys("www/ASP", "www/sharepoint", "Settings/ParanoidReport");
      script_exclude_keys("Settings/disable_cgi_scanning");
      script_require_ports("Services/www", 80);
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("smb_func.inc");
    include("misc_func.inc");
    include("http.inc");
    include("webapp_func.inc");
    
    if ( get_kb_item("SMB/dont_send_in_cleartext" ) ) exit(0);
    
    if (report_paranoia < 2)
      exit(1, "This plugin only runs if 'Report paranoia' is set to 'Paranoid'.");
    
    port = get_http_port(default:80, asp:TRUE);
    install = get_install_from_kb(appname:'sharepoint', port:port, exit_on_fail:TRUE);
    
    function get_http_code()
    {
      local_var res, headers, http_code;
      res = _FCT_ANON_ARGS[0];
      if (isnull(res)) return NULL;
    
      headers = parse_http_headers(status_line:res[0], headers:res[1]);
      if (isnull(headers)) exit(1, 'Error parsing HTTP headers on port '+port+'.');
    
      http_code = headers['$code'];
      if (isnull(http_code)) exit(1, "Error parsing HTTP response code");
    
      return http_code;
    }
    
    
    url = install['dir']+'/_layouts/help.aspx';
    dos_qs = '?tid=1&'+SCRIPT_NAME+'='+unixtime();
    vuln = FALSE;
    
    # First, make sure the page is accessible
    res = http_send_recv3(
      method:'GET',
      item:url,
      port:port,
      username:kb_smb_login(),
      password:kb_smb_password(),
      exit_on_fail:TRUE
    );
    
    code = get_http_code(res);
    if (code == 401) exit(1, 'Authentication failed on port '+port+'.');
    if ('<title>Help</title>' >!< res[2] || '<br/>Cannot display help.<br/>' >!< res[2])
      exit(1, 'Error retrieving '+build_url(qs:url,port:port));
    
    # Next, attempt to trigger the DoS
    res = http_send_recv3(
      method:'GET',
      item:url+dos_qs,
      port:port,
      username:kb_smb_login(),
      password:kb_smb_password()
    );
    
    # Check if there is a timeout.  Otherwise, check for a HTTP 503
    # (which likely means the application pool has stopped)
    if (isnull(res)) vuln = TRUE;
    else
    {
      code = get_http_code(res);
      if (code == 503 && res[2] == '<h1>Service Unavailable</h1>')
        vuln = TRUE;
    }
    
    if (vuln)
    {
      if (report_verbosity > 0)
      {
        report = get_vuln_report(items:url+dos_qs, port:port);
        security_warning(port:port, extra:report);
      }
      else security_warning(port);
    }
    else exit(0, 'SharePoint Services on port '+port+' is not affected.');
    

Oval

accepted2013-11-11T04:02:58.962-05:00
classvulnerability
contributors
  • nameDragos Prisaca
    organizationSymantec Corporation
  • nameDragos Prisaca
    organizationG2, Inc.
  • nameChandan S
    organizationSecPod Technologies
definition_extensions
  • commentMicrosoft Windows Server 2003 (32-bit) is installed
    ovaloval:org.mitre.oval:def:1870
  • commentMicrosoft Windows Server 2003 (x64) is installed
    ovaloval:org.mitre.oval:def:730
descriptionUnspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability."
familywindows
idoval:org.mitre.oval:def:7241
statusaccepted
submitted2010-06-08T13:00:00
titleSharepoint Help Page Denial of Service Vulnerability
version27