Microsoft SharePoint Help Page Remote Denial of Service Vulnerability

Bugtraq ID:	40559
Class:	Design Error
CVE:	CVE-2010-1264
Remote:	Yes
Local:	No
Published:	Jun 08 2010 12:00AM
Updated:	Jun 10 2010 07:09PM
Credit:	Rik Jones of the Dallas County Community College District
Vulnerable:	Microsoft SharePoint Server 2007 x64 SP2 Microsoft SharePoint Server 2007 x64 SP1 Microsoft SharePoint Server 2007 x64 0 Microsoft SharePoint Server 2007 SP2 Microsoft SharePoint Server 2007 SP1 Microsoft SharePoint Server 2007 0 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Messaging Application Server 0 Avaya Meeting Exchange - Webportal 6.0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0
Not Vulnerable:

Microsoft SharePoint Help Page Remote Denial of Service Vulnerability

Microsoft SharePoint is prone to a remote denial-of-service vulnerability.

A remote attacker can exploit this issue to crash the affected application, denying service to legitimate users.

Microsoft SharePoint Help Page Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft SharePoint Help Page Remote Denial of Service Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft SharePoint Server 2007 SP2

• Microsoft Security Update for Microsoft Office SharePoint Server 3.0 (KB979445), 32-bit Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=52a55423-f33b -4cd1-919d-806972a553df

Microsoft SharePoint Server 2007 SP1

• Microsoft Security Update for Microsoft Office SharePoint Server 3.0 (KB979445), 32-bit Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=52a55423-f33b -4cd1-919d-806972a553df

Microsoft SharePoint Server 2007 x64 SP1

• Microsoft Security Update for Microsoft Office SharePoint Server 2007 (KB979445), 64-bit Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=4d84a25b-532f -4319-9ab2-90e5b82ebd90

Microsoft SharePoint Server 2007 x64 SP2

• Microsoft Security Update for Microsoft Office SharePoint Server 2007 (KB979445), 64-bit Edition
  http://www.microsoft.com/downloads/details.aspx?familyid=4d84a25b-532f -4319-9ab2-90e5b82ebd90

Microsoft SharePoint Help Page Remote Denial of Service Vulnerability

References:

• Microsoft SharePoint Homepage (Microsoft)
  
• ASA-2010-154 MS10-039 Vulnerabilities in Microsoft SharePoint Could Allow Elevat (Avaya)
  
• Microsoft Security Bulletin MS10-039 (Microsoft)