Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability

Bugtraq ID:	43703
Class:	Design Error
CVE:	CVE-2010-3243
Remote:	Yes
Local:	No
Published:	Oct 12 2010 12:00AM
Updated:	Oct 15 2010 03:19PM
Credit:	Sirdarckcat of Google Inc.
Vulnerable:	Microsoft Windows SharePoint Services 3.0 + 3DM Software Disk Management Software SP2 + 3DM Software Disk Management Software SP1 Platform SDK + 3DM Software Disk Management Software SP1 + Microsoft Windows Server 2003 Datacenter Edition SP1 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter x64 Edition SP2 + Microsoft Windows Server 2003 Datacenter x64 Edition + Microsoft Windows Server 2003 Enterprise Edition SP1 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise x64 Edition SP2 + Microsoft Windows Server 2003 Enterprise x64 Edition + Microsoft Windows Server 2003 Standard Edition SP2 + Microsoft Windows Server 2003 Standard Edition SP1 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Web Edition SP2 + Microsoft Windows Server 2003 Web Edition SP1 + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP1 Microsoft Windows SharePoint Services Microsoft SharePoint Services 64-bit 3.0 SP2 Microsoft SharePoint Services 64-bit 3.0 SP1 Microsoft SharePoint Services 64-bit 3.0 Microsoft SharePoint Services 64-bit 3.0 Microsoft SharePoint Services 3.0 SP2 Microsoft SharePoint Services 3.0 SP1 Microsoft SharePoint Server 2007 x64 SP2 Microsoft SharePoint Server 2007 x64 SP1 Microsoft SharePoint Server 2007 x64 0 Microsoft SharePoint Server 2007 Standard Edition 0 Microsoft SharePoint Server 2007 Enterprise Edition 0 Microsoft SharePoint Server 2007 SP2 Microsoft SharePoint Server 2007 SP1 Microsoft SharePoint Server 2007 0 Microsoft Internet Explorer 8 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Messaging Application Server 0 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Communication Server 1000 Telephony Manager 0 Avaya CallPilot 0 Avaya Aura Conferencing Standard Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability

Microsoft Internet Explorer is prone to an information-disclosure vulnerability that affects the 'toStaticHTML' API.

Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.

Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Microsoft SharePoint Services 3.0 SP2

• Microsoft wss-kb2345304-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=12fd97a9-6fb8 -4b65-a497-a56587f114e1

Microsoft SharePoint Services 64-bit 3.0 SP2

• Microsoft wss-kb2345304-fullfile-x64-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=58d1e91d-a037 -485d-a6d9-80fbf403b108

Microsoft Internet Explorer 8

• Microsoft Windows6.1-KB2360131-ia64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=bbaa9f46-8fc7 -4c44-b38c-dc3d5210f63d


• Microsoft IE8-Windows6.0-KB2360131-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=adeb3036-62fa -4a29-b82f-ff4a50c05996


• Microsoft Windows6.1-KB2360131-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=6595770f-e580 -4613-a83a-3b8ee4cc30f1


• Microsoft IE8-WindowsServer2003-KB2360131-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=9af37f62-5585 -4ff5-9dd3-3fa0b148ae08


• Microsoft Windows6.1-KB2360131-x64.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=ffe364ee-e2ae -466c-b727-14b1a976a860


• Microsoft IE8-Windows6.0-KB2360131-x86.msu
  http://www.microsoft.com/downloads/details.aspx?familyid=191c8388-f1ef -45b6-9f07-d5654a973abe


• Microsoft IE8-WindowsServer2003.WindowsXP-KB2360131-x64-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=05413f6c-b4be -4892-b4b3-c54dd01fd95d


• Microsoft IE8-WindowsXP-KB2360131-x86-ENU.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=93580299-d764 -417f-a7fa-ee441fea2bb3

Microsoft SharePoint Server 2007 x64 SP2

• Microsoft office2007-kb2345212-fullfile-x64-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=e5e60751-242a -4fdb-9852-6d94050d3d0e

Microsoft SharePoint Server 2007 SP2

• Microsoft office2007-kb2345212-fullfile-x86-glb.exe
  http://www.microsoft.com/downloads/details.aspx?familyid=aee3f2de-ccf3 -4d32-b468-eede4e8afcd4

Microsoft Internet Explorer 'toStaticHTML' HTML Sanitizing Information Disclosure Vulnerability

References:

• Microsoft Internet Explorer Homepage (Microsoft)
  
• ASA-2010-278 MS10-071 Cumulative Security Update for Internet Explorer (2360131) (Avaya)
  
• Microsoft Security Bulletin MS10-071 (Microsoft)
  
• Microsoft Security Bulletin MS10-072 (Microsoft)