Microsoft Remote Desktop Web Access CVE-2011-1263 Cross Site Scripting Vulnerability

Bugtraq ID:	49040
Class:	Input Validation Error
CVE:	CVE-2011-1263
Remote:	Yes
Local:	No
Published:	Aug 09 2011 12:00AM
Updated:	Aug 09 2011 12:00AM
Credit:	Sven Taute
Vulnerable:	Microsoft Windows Server 2008 R2 x64 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 0
Not Vulnerable:

Microsoft Remote Desktop Web Access CVE-2011-1263 Cross Site Scripting Vulnerability

Microsoft Remote Desktop Web Access is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

Microsoft Remote Desktop Web Access CVE-2011-1263 Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Microsoft Remote Desktop Web Access CVE-2011-1263 Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Microsoft Windows Server 2008 R2 x64 0

• Microsoft Security Update for Windows Server 2008 R2 x64 Edition (KB2546250)
  http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27 002

Microsoft Remote Desktop Web Access CVE-2011-1263 Cross Site Scripting Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS11-061 - Important (Microsoft)