Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege
Informations
Name MS12-066 First vendor Publication 2012-10-09
Vendor Microsoft Last vendor Modification 2014-01-15
Severity (Vendor) Version Revision 1.4

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Severity Rating: Important
Revision Note: V1.4 (January 15, 2014): Bulletin revised to announce a detection change in update 2687356 (a.k.a. 2687442). This is a detection change only. Customers who have already successfully updated their systems do not need to take any action. Note that update 2687356 is offered through Microsoft Update as update 2687442.
Summary: This security update resolves a publicly disclosed vulnerability in Microsoft Office, Microsoft Communications Platforms, Microsoft Server software, and Microsoft Office Web Apps. The vulnerability could allow elevation of privilege if an attacker sends specially crafted content to a user. clicks a specially crafted URL that takes the user to a targeted SharePoint site.

Original Source

Url : https://technet.microsoft.com/en-us/library/security/MS12-066

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:14976
 
Oval ID: oval:org.mitre.oval:def:14976
Title: Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege - MS12-066
Description: Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2012-2520
 Version: 13
Platform(s): Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows XP
 Product(s): Microsoft Communicator 2007 R2
Microsoft Groove Server 2010
Microsoft InfoPath 2007
Microsoft InfoPath 2010
Microsoft Lync 2010
Microsoft Lync 2010 Attendee
Microsoft Office Web Apps 2010
Microsoft SharePoint Foundation 2010
Microsoft SharePoint Server 2007
Microsoft SharePoint Server 2010
Microsoft SharePoint Services 3.0
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 2
Application 2
Application 1
Application 1
Application 1
Application 3
Application 1

OpenVAS Exploits

Date Description
2012-10-10 Name : Microsoft Products HTML Sanitisation Component XSS Vulnerability (2741517)
File : nvt/secpod_ms12-066.nasl

Snort® IPS/IDS

Date Description
2014-01-10 Microsoft multiple product toStaticHTML XSS attempt
RuleID : 23137 - Revision : 11 - Type : BROWSER-IE
2014-01-10 Microsoft multiple product toStaticHTML XSS attempt
RuleID : 23136 - Revision : 11 - Type : BROWSER-IE

Nessus® Vulnerability Scanner

Date Description
2012-10-10 Name : The remote host is affected by a privilege escalation vulnerability.
File : smb_nt_ms12-066.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
Date Informations
2016-04-27 01:59:58
  • Multiple Updates
2014-05-06 11:35:06
  • Multiple Updates
2014-05-06 11:31:59
  • Multiple Updates
2014-04-19 00:26:06
  • Multiple Updates
2014-04-19 00:17:28
  • Multiple Updates
2014-04-18 21:28:35
  • Multiple Updates
2014-04-18 21:18:48
  • Multiple Updates
2014-04-18 17:26:21
  • Multiple Updates
2014-04-18 17:17:54
  • Multiple Updates
2014-04-18 13:29:51
  • Multiple Updates
2014-04-18 13:18:42
  • Multiple Updates
2014-04-18 09:27:07
  • Multiple Updates
2014-04-18 09:18:06
  • Multiple Updates
2014-04-18 05:27:59
  • Multiple Updates
2014-04-18 05:19:16
  • Multiple Updates
2014-04-18 00:26:18
  • Multiple Updates
2014-04-18 00:17:41
  • Multiple Updates
2014-04-17 21:25:56
  • Multiple Updates
2014-04-17 21:18:34
  • Multiple Updates
2014-04-17 17:26:35
  • Multiple Updates
2014-04-17 17:17:49
  • Multiple Updates
2014-04-17 13:29:28
  • Multiple Updates
2014-04-17 13:18:48
  • Multiple Updates
2014-04-17 09:07:46
  • Multiple Updates
2014-02-17 11:47:27
  • Multiple Updates
2014-01-19 21:30:53
  • Multiple Updates
2014-01-16 00:22:34
  • Multiple Updates
2014-01-16 00:16:10
  • Multiple Updates
2013-11-04 21:33:30
  • Multiple Updates
2013-05-11 00:50:03
  • Multiple Updates