Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
TitleVulnerability in Active Directory Certificate Services Web Enrollment Could Allow Elevation of Privilege (2518295)
Informations
NameMS11-051First vendor Publication2011-06-14
VendorMicrosoftLast vendor Modification2011-06-15
Severity (Vendor) ImportantRevision 1.1

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score4.3Attack RangeNetwork
Cvss Impact Score2.9Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Severity Rating: Important

Revision Note: V1.1 (June 15, 2011): Clarified the XSS Filter mitigation.

Summary: This security update resolves a privately reported vulnerability in Active Directory Certificate Services Web Enrollment. The vulnerability is a cross-site scripting (XSS) vulnerability that could allow elevation of privilege, enabling an attacker to execute arbitrary commands on the site in the context of the target user. An attacker who successfully exploited this vulnerability would need to send a specially crafted link and convince a user to click the link. In all cases, however, an attacker would have no way to force a user to visit the Web site. Instead, an attacker would have to persuade a user to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes the user to the vulnerable Web site.

Original Source

Url : http://technet.microsoft.com/en-us/security/bulletin/ms11-051

CWE : Common Weakness Enumeration

idName
CWE-79Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12749
 
Oval ID: oval:org.mitre.oval:def:12749
Title: Active Directory Certificate Services Vulnerability
Description: Cross-site scripting (XSS) vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, R2, and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "Active Directory Certificate Services Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2011-1264
Version: 6
Platform(s): Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Os1
Os1
Os6

OpenVAS Exploits

DateDescription
2011-06-15Name : Active Directory Certificate Services Web Enrollment Elevation of Privilege V...
File : nvt/secpod_ms11-051.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
72937Microsoft Windows Active Directory Certificate Services Web Enrollment XSS

Information Assurance Vulnerability Management (IAVM)

DateDescription
2011-06-16IAVM : 2011-B-0068 - Microsoft Active Directory Certificate Services Web Enrollment Privilege Esca...
Severity : Category II - VMSKEY : V0028615

Snort® IPS/IDS

DateDescription
2014-01-10Microsoft Windows Vector Markup Language imagedata page deconstruction attempt
RuleID : 19242 - Revision : 9 - Type : BROWSER-IE
2014-01-10Microsoft Windows Vector Markup Language imagedata page deconstruction attempt
RuleID : 19241 - Revision : 9 - Type : BROWSER-IE
2014-01-10Microsoft Certification service XSS attempt
RuleID : 19186 - Revision : 6 - Type : OS-WINDOWS

Nessus® Vulnerability Scanner

DateDescription
2011-06-15Name : The remote Windows host has an ASP application with a cross-site scripting vu...
File : smb_nt_ms11-051.nasl - Type : ACT_GATHER_INFO
2011-06-15Name : The remote Active Directory Certificate Services Web Enrollment server is vul...
File : microsoft_certsrv_anon_ms11-051.nasl - Type : ACT_ATTACK

Alert History

If you want to see full details history, please login or register.
0
1
2
DateInformations
2014-02-17 11:47:01
  • Multiple Updates
2014-01-19 21:30:41
  • Multiple Updates
2013-11-11 12:41:23
  • Multiple Updates