Microsoft AntiXSS Library Sanitization Module Security Bypass Vulnerability

Bugtraq ID:	51291
Class:	Design Error
CVE:	CVE-2012-0007
Remote:	Yes
Local:	No
Published:	Jan 10 2012 12:00AM
Updated:	Jan 19 2012 02:00PM
Credit:	Adi Cohen of IBM Rational Application Security
Vulnerable:	Microsoft Anti-Cross Site Scripting Library 4.0 Microsoft Anti-Cross Site Scripting Library 3 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya Aura Conferencing 6.0 Standard
Not Vulnerable:

Microsoft AntiXSS Library Sanitization Module Security Bypass Vulnerability

Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.

An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.

Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.

Microsoft AntiXSS Library Sanitization Module Security Bypass Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

The following example inputs are available:

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>")

Microsoft AntiXSS Library Sanitization Module Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Microsoft Anti-Cross Site Scripting Library 4.0

• Microsoft Microsoft Anti-Cross Site Scripting Library V4.2
  http://www.microsoft.com/downloads/details.aspx?familyid=b3ef05ce-70fe -4f25-9aee-cb7a42a53d11

Microsoft Anti-Cross Site Scripting Library 3

• Microsoft Microsoft Anti-Cross Site Scripting Library V4.2
  http://www.microsoft.com/downloads/details.aspx?familyid=b3ef05ce-70fe -4f25-9aee-cb7a42a53d11

Microsoft AntiXSS Library Sanitization Module Security Bypass Vulnerability

References:

• Microsoft Anti-XSS Library Bypass (MS12-007) (Watchfire )
  
• Microsoft Homepage (Microsoft)
  
• ASA-2012-020 MS12-007 Vulnerability in AntiXSS Library Could Allow Information D (Avaya)
  
• Microsoft Security Bulletin MS12-007 (Microsoft)