Microsoft SharePoint Server Cross-Site Scripting Vulnerability

Bugtraq ID:	23832
Class:	Input Validation Error
CVE:	CVE-2007-2581
Remote:	Yes
Local:	No
Published:	May 04 2007 12:00AM
Updated:	Oct 10 2007 05:28PM
Credit:	Solarius is credited with the discovery of this vulnerability.
Vulnerable:	Microsoft Windows SharePoint Services 3.0 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 SP1 Platform SDK + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2003 Datacenter Edition SP1 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter x64 Edition SP2 + Microsoft Windows Server 2003 Datacenter x64 Edition + Microsoft Windows Server 2003 Enterprise Edition SP1 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise x64 Edition SP2 + Microsoft Windows Server 2003 Enterprise x64 Edition + Microsoft Windows Server 2003 Standard Edition SP2 + Microsoft Windows Server 2003 Standard Edition SP1 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Web Edition SP2 + Microsoft Windows Server 2003 Web Edition SP1 + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP1 Microsoft SharePoint Server 2007 0 Microsoft Microsoft Office SharePoint Server 2007 x64 0 Microsoft Microsoft Office SharePoint Server 2007 0
Not Vulnerable:

Microsoft SharePoint Server Cross-Site Scripting Vulnerability

Microsoft SharePoint Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

Microsoft SharePoint Server Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI. The following example is available:

• /data/vulnerabilities/exploits/23832.html

Microsoft SharePoint Server Cross-Site Scripting Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue in supported versions of affected applications. Please see the referenced advisory for details on obtaining and applying the appropriate updates.


Microsoft Microsoft Office SharePoint Server 2007 x64 0

• Microsoft Security Update for Microsoft Office SharePoint Server 2007 x64 (KB937832)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=1D319164-D133 -4493-BE27-1AEDA62362C4&displaylang=en

Microsoft Microsoft Office SharePoint Server 2007 0

• Microsoft Security Update for Microsoft Office SharePoint Server 2007 (KB937832)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=AAEA9695-F541 -4C4C-9107-81EAD5CFC8C9&displaylang=en

Microsoft Windows SharePoint Services 3.0

• Microsoft Security Update for Windows SharePoint Services 3.0 (KB934525)
  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2
  http://www.microsoft.com/downloads/details.aspx?FamilyId=76FC2225-2802 -46E5-A294-A842E3841877&displaylang=en


• Microsoft Security Update for Windows SharePoint Services 3.0 x64 Edition (KB934525)
  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2
  http://www.microsoft.com/downloads/details.aspx?FamilyId=667335DD-DF2E -4F14-A130-5758701BE055&displaylang=en

Microsoft SharePoint Server Cross-Site Scripting Vulnerability

References:

• Microsoft SharePoint Homepage (Microsoft)
  
• XSS in Microsoft SharePoint ([email protected])
  
• Microsoft Security Bulletin MS07-059 - Important (Microsoft)