SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Microsoft SharePoint Vendors:   Microsoft
Microsoft SharePoint Bugs Let Remote Users Conduct Cross-Site Scripting Attacks and Remote Authenticated Users Execute Arbitrary Code
SecurityTracker Alert ID:  1030227
SecurityTracker URL:  http://securitytracker.com/id/1030227
CVE Reference:   CVE-2014-0251, CVE-2014-1754, CVE-2014-1813   (Links to External Site)
Date:  May 13 2014
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Server 2007, 2010, 2013; Office Web Apps 2010, 2013; SharePoint Services 3.0; SharePoint Foundation 2010, 2013; SharePoint Designer 2007, 2010, 2013
Description:   Several vulnerabilities were reported in Microsoft SharePoint. A remote authenticated user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks.

A remote authenticated user can send a specially crafted page to execute arbitrary code on the target system [CVE-2014-0251]. The code will run with the privileges of the target W3WP service.

A remote user can cause arbitrary scripting code to be executed by the target user's browser [CVE-2014-1754]. The code will originate from the site running the Microsoft SharePoint software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A remote authenticated user can send a specially crafted page to trigger a flaw in Microsoft Web Applications and execute arbitrary code on the target system [CVE-2014-1813]. The code will run with the privileges of the target W3WP service.

Impact:   A remote authenticated user can execute arbitrary code on the target system with the privileges of the target W3WP service.

A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Microsoft SharePoint software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Solution:   The vendor has issued the following fixes:

Microsoft Windows SharePoint Services 3.0 Service Pack 3 (32-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=bac01fe7-b4c7-47b0-9d0a-031779f31035

SharePoint Server 2007 Service Pack 3 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=7592ab3f-68c4-4ab5-90f6-01adb2b1af2c

SharePoint Server 2007 Service Pack 3 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=ae6e6631-7d10-4922-9bb3-3444faade326

Microsoft Windows SharePoint Services 3.0 Service Pack 3 (64-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=e148552c-a000-43d2-ad46-382099502b3c

SharePoint Server 2007 Service Pack 3 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=9c5c31dd-b364-4965-b49c-d4550c1b083c

SharePoint Server 2007 Service Pack 3 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=19ffa7ba-dbc6-4050-afde-27422c5d5d02

Microsoft SharePoint Foundation 2010 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=0c7ebf39-b293-4230-8e08-c13d71fe1c42

Microsoft SharePoint Foundation 2010 Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=0c7ebf39-b293-4230-8e08-c13d71fe1c42

Microsoft SharePoint Server 2010 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=d58142aa-70a4-486d-a6bf-c4a980ee2bc3

Microsoft SharePoint Server 2010 Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=d58142aa-70a4-486d-a6bf-c4a980ee2bc3

Microsoft SharePoint Foundation 2013:

http://www.microsoft.com/downloads/details.aspx?familyid=eb47f8b8-09ef-4bdb-b88a-ee5335b0bbec

Microsoft SharePoint Foundation 2013 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=eb47f8b8-09ef-4bdb-b88a-ee5335b0bbec

Microsoft SharePoint Foundation 2013:

http://www.microsoft.com/downloads/details.aspx?familyid=224981ae-e4be-4be9-9dd3-8a8da0deeecb

Microsoft SharePoint Foundation 2013 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=224981ae-e4be-4be9-9dd3-8a8da0deeecb

Microsoft SharePoint Server 2013:

http://www.microsoft.com/downloads/details.aspx?familyid=4526c29c-c50d-4f77-8b0d-8b5a9a168d51

Microsoft SharePoint Server 2013 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=4526c29c-c50d-4f77-8b0d-8b5a9a168d51

Microsoft Project Server 2010 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=a266a604-5340-4314-aae9-bc6de64c0689

Microsoft Project Server 2010 Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=a266a604-5340-4314-aae9-bc6de64c0689

Microsoft Project Server 2013:

http://www.microsoft.com/downloads/details.aspx?familyid=e6594906-da75-49a2-888c-ee1285c0b323

Microsoft Project Server 2013 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=e6594906-da75-49a2-888c-ee1285c0b323

Microsoft Web Applications 2010 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=279074e5-a636-4a87-998b-00846f807349

Microsoft Web Applications 2010 Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=279074e5-a636-4a87-998b-00846f807349

Microsoft Office Web Apps Server 2013:

http://www.microsoft.com/downloads/details.aspx?familyid=8d47f9b7-eb08-45e6-b7e3-4440eae1b02c

Microsoft Office Web Apps Server 2013 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=8d47f9b7-eb08-45e6-b7e3-4440eae1b02c

SharePoint Server 2013 Client Components SDK (32-bit version):

http://www.microsoft.com/downloads/details.aspx?familyid=6985ca91-3ef8-46dc-bde6-216cf0b77a99

SharePoint Server 2013 Client Components SDK (64-bit version):

http://www.microsoft.com/downloads/details.aspx?familyid=74c696c5-11c6-46e1-a0dc-6dcadfadcdf9

Microsoft SharePoint Designer 2007 Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=e7ed1f0a-d819-4eef-b37c-72b7ab6f3f3b

Microsoft SharePoint Designer 2007 Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=c23b6ad8-a09f-4903-8cba-628442373229

Microsoft SharePoint Designer 2010 Service Pack 1 (32-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=fb46dc78-1fe3-4a27-9d75-135888610c03

Microsoft SharePoint Designer 2010 Service Pack 2 (32-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=fb46dc78-1fe3-4a27-9d75-135888610c03

Microsoft SharePoint Designer 2010 Service Pack 1 (64-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=61817c56-6b35-42e3-9ee4-4799b565101b

Microsoft SharePoint Designer 2010 Service Pack 2 (64-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=61817c56-6b35-42e3-9ee4-4799b565101b

Microsoft SharePoint Designer 2013 (32-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=18def48d-4ad2-4b4f-8eb4-85930759c010

Microsoft SharePoint Designer 2013 Service Pack 1 (32-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=18def48d-4ad2-4b4f-8eb4-85930759c010

Microsoft SharePoint Designer 2013 (32-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=9e4c54c6-c793-4a30-a677-1c54e1e3551e

Microsoft SharePoint Designer 2013 Service Pack 1 (32-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=9e4c54c6-c793-4a30-a677-1c54e1e3551e

Microsoft SharePoint Designer 2013 (64-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=43eaecff-e75b-444d-89e5-d6dbf2c28134

Microsoft SharePoint Designer 2013 Service Pack 1 (64-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=43eaecff-e75b-444d-89e5-d6dbf2c28134

Microsoft SharePoint Designer 2013 (64-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=6b25aa3c-de26-4b0d-8760-80945f5bf67e

Microsoft SharePoint Designer 2013 Service Pack 1 (64-bit versions):

http://www.microsoft.com/downloads/details.aspx?familyid=6b25aa3c-de26-4b0d-8760-80945f5bf67e

A restart may be required.

The Microsoft advisory is available at:

https://technet.microsoft.com/library/security/ms14-022

Vendor URL:  technet.microsoft.com/library/security/ms14-022 (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (2003), Windows (2008), Windows (2012)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC