Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability

Bugtraq ID:	17452
Class:	Input Validation Error
CVE:	CVE-2006-0015
Remote:	Yes
Local:	No
Published:	Apr 11 2006 12:00AM
Updated:	Apr 13 2006 06:07PM
Credit:	Esteban Martínez Fayó is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional Microsoft Windows XP Home SP2 Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition Itanium SP1 Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium SP1 Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft SharePoint Team Services 2002 + Microsoft Office XP SP1 Microsoft FrontPage Server Extensions 2002
Not Vulnerable:	Microsoft Windows SharePoint Services Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Microsoft FrontPage Server Extensions 2000 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Advanced Server SP2 + Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Datacenter Server SP2 + Microsoft Windows 2000 Datacenter Server SP1 + Microsoft Windows 2000 Datacenter Server + Microsoft Windows 2000 Professional SP3 + Microsoft Windows 2000 Professional SP2 + Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Server SP3 + Microsoft Windows 2000 Server SP2 + Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional Microsoft FrontPage 2002 + Microsoft Office XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional

Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability

Microsoft FrontPage Server Extensions are prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before it is rendered to other users.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user, with the privileges of the victim userâ??s account. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability

This issue can be exploited through a web client.

An example HTML form demonstrating this issue is availble:

<form action=http://www.example.com/_vti_bin/_vti_adm/fpadmdll.dll method="POST">
<input type="hidden" name="operation" value="--><script>alert()</script>">
<input type="hidden" name="action" value="none">
<input type="hidden" name="port" value="/LM/W3SVC/1:">
<input type="submit" name="page" value="healthrp.htm">
</form>

Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability

Solution:

The vendor has released fixes to address this issue; please see the reference section for further details.


Microsoft Windows Server 2003 Enterprise Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB908981)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?familyid=5C03F85A-5228 -47FB-A338-90FA23818E08

Microsoft Windows Server 2003 Enterprise Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-Based Systems (KB908981)
  for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 with SP1, both for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?familyid=59F15A6B-CC1B -43D5-A007-BFC9ABB63486

Microsoft SharePoint Team Services 2002

• Microsoft Security Update for SharePoint Team Services (KB911701)
  Microsoft SharePoint Team Services 2002
  http://www.microsoft.com/downloads/details.aspx?familyid=EEE40662-39E6 -4C07-8241-1AC4F5D24FFC

Microsoft FrontPage Server Extensions 2002

• Microsoft Security Update for FrontPage 2002 Server Extensions (KB911831)
  for Microsoft Windows Server 2000 Service Pack 4, Microsoft Windows XP Service Pack 1, and Microsoft Windows XP Service Pack 2
  http://www.microsoft.com/downloads/details.aspx?familyid=F453530D-7063 -49AB-B304-9C455DE6D8DA


• Microsoft Security Update for FrontPage 2002 Server Extensions (KB911831)
  for Microsoft Windows Server 2003 X64 Edition and Microsoft Windows XP Professional x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=F453530D-7063 -49AB-B304-9C455DE6D8DA


• Microsoft Security Update for Windows Server 2003 (KB908981)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?familyid=5C03F85A-5228 -47FB-A338-90FA23818E08


• Microsoft Security Update for Windows Server 2003 for Itanium-Based Systems (KB908981)
  for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 with SP1, both for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?familyid=59F15A6B-CC1B -43D5-A007-BFC9ABB63486

Microsoft Windows Server 2003 Datacenter Edition Itanium SP1

• Microsoft Security Update for Windows Server 2003 for Itanium-Based Systems (KB908981)
  for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 with SP1, both for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?familyid=59F15A6B-CC1B -43D5-A007-BFC9ABB63486

Microsoft Windows XP Professional SP2

• Microsoft Security Update for FrontPage 2002 Server Extensions (KB911831)
  for Microsoft Windows Server 2000 Service Pack 4, Microsoft Windows XP Service Pack 1, and Microsoft Windows XP Service Pack 2
  http://www.microsoft.com/downloads/details.aspx?familyid=F453530D-7063 -49AB-B304-9C455DE6D8DA

Microsoft Windows Server 2003 Standard x64 Edition

• Microsoft Security Update for FrontPage 2002 Server Extensions (KB911831)
  for Microsoft Windows Server 2003 X64 Edition and Microsoft Windows XP Professional x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=F453530D-7063 -49AB-B304-9C455DE6D8DA

Microsoft Windows XP Professional x64 Edition

• Microsoft Security Update for FrontPage 2002 Server Extensions (KB911831)
  for Microsoft Windows Server 2003 X64 Edition and Microsoft Windows XP Professional x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=F453530D-7063 -49AB-B304-9C455DE6D8DA

Microsoft Windows Server 2003 Enterprise x64 Edition

• Microsoft Security Update for FrontPage 2002 Server Extensions (KB911831)
  for Microsoft Windows Server 2003 X64 Edition and Microsoft Windows XP Professional x64 Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=F453530D-7063 -49AB-B304-9C455DE6D8DA

Microsoft Windows Server 2003 Enterprise Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-Based Systems (KB908981)
  for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 with SP1, both for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?familyid=59F15A6B-CC1B -43D5-A007-BFC9ABB63486

Microsoft Windows XP Home SP2

• Microsoft Security Update for FrontPage 2002 Server Extensions (KB911831)
  for Microsoft Windows Server 2000 Service Pack 4, Microsoft Windows XP Service Pack 1, and Microsoft Windows XP Service Pack 2
  http://www.microsoft.com/downloads/details.aspx?familyid=F453530D-7063 -49AB-B304-9C455DE6D8DA

Microsoft Windows Server 2003 Standard Edition SP1

• Microsoft Security Update for Windows Server 2003 (KB908981)
  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1
  http://www.microsoft.com/downloads/details.aspx?familyid=5C03F85A-5228 -47FB-A338-90FA23818E08

Microsoft Windows Server 2003 Datacenter Edition Itanium 0

• Microsoft Security Update for Windows Server 2003 for Itanium-Based Systems (KB908981)
  for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 with SP1, both for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?familyid=59F15A6B-CC1B -43D5-A007-BFC9ABB63486

Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability

References:

• FrontPage Product Page (Microsoft)
  
• Microsoft Security Bulletin MS06-017 (Microsoft)
  
• Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Sc ("Esteban Martinez Fayo" )