-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0662
Vulnerabilities in SharePoint Could Allow Elevation of Privilege (2695502)
                               10 July 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Microsoft InfoPath 2007
                   Microsoft InfoPath 2010
                   Microsoft Office SharePoint Server 2007
                   Microsoft SharePoint Server 2010
                   Microsoft Groove Server 2010
                   Microsoft Windows SharePoint Services 3.0
                   Microsoft SharePoint Foundation 2010
                   Microsoft Office Web Apps 2010
Publisher:         Microsoft
Operating System:  Windows
Impact/Access:     Increased Privileges           -- Remote with User Interaction
                   Cross-site Scripting           -- Remote with User Interaction
                   Access Confidential Data       -- Remote/Unauthenticated      
                   Provide Misleading Information -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-1863 CVE-2012-1862 CVE-2012-1861
                   CVE-2012-1860 CVE-2012-1859 CVE-2012-1858

Reference:         ESB-2012.0540
                   ESB-2012.0534

Original Bulletin: 
   http://technet.microsoft.com/en-us/security/bulletin/MS12-050

- --------------------------BEGIN INCLUDED TEXT--------------------

Microsoft Security Bulletin MS12-050 - Important

Vulnerabilities in SharePoint Could Allow Elevation of Privilege (2695502)

Published Date: July 10, 2012

Version: 1.0

General Information

Executive Summary

This security update resolves one publicly disclosed and five privately 
reported vulnerabilities in Microsoft SharePoint and Windows SharePoint 
Services. The most severe vulnerabilities could allow elevation of privilege 
if a user clicks a specially crafted URL that takes the user to a targeted 
SharePoint site.

This security update is rated Important for supported editions of Microsoft 
InfoPath 2007, Microsoft InfoPath 2010, Microsoft SharePoint Server 2007, 
Microsoft SharePoint Server 2010, and Microsoft Groove Server 2010; and for 
supported versions of Microsoft Windows SharePoint Services 3.0 and SharePoint 
Foundation 2010. For more information, see the subsection, Affected and 
Non-Affected Software, in this section.

Affected Software

Microsoft InfoPath 2007 Service Pack 2
Microsoft InfoPath 2007 Service Pack 2
Microsoft InfoPath 2007 Service Pack 3
Microsoft InfoPath 2007 Service Pack 3
Microsoft InfoPath 2010 (32-bit editions)
Microsoft InfoPath 2010 (32-bit editions)
Microsoft InfoPath 2010 Service Pack 1 (32-bit editions)
Microsoft InfoPath 2010 Service Pack 1 (32-bit editions)
Microsoft InfoPath 2010 (64-bit editions)
Microsoft InfoPath 2010 (64-bit editions)
Microsoft InfoPath 2010 Service Pack 1 (64-bit editions)
Microsoft InfoPath 2010 Service Pack 1 (64-bit editions)
Microsoft Office SharePoint Server 2007 Service Pack 2 (32-bit editions)
Microsoft Office SharePoint Server 2007 Service Pack 3 (32-bit editions)[1]
Microsoft Office SharePoint Server 2007 Service Pack 2 (64-bit editions)[1]
Microsoft Office SharePoint Server 2007 Service Pack 3 (64-bit editions)[1]
Microsoft SharePoint Server 2010 
Microsoft SharePoint Server 2010 Service Pack 1
Microsoft Groove Server 2010
Microsoft Groove Server 2010 Service Pack 1
Microsoft Windows SharePoint Services 3.0 Service Pack 2 (32-bit version)
Microsoft Windows SharePoint Services 3.0 Service Pack 2 (64-bit version)
Microsoft SharePoint Foundation 2010
Microsoft SharePoint Foundation 2010 Service Pack 1
Microsoft Office Web Apps 2010
Microsoft Office Web Apps 2010 Service Pack 1

[1] For supported editions of Microsoft Office SharePoint Server 2007, in 
addition to security update packages for Microsoft Office SharePoint 2007 
(KB2596663 and KB2596942), customers also need to install the security update 
for Microsoft Windows SharePoint Services 3.0 (KB2596911) to be protected from 
the vulnerabilities described in this bulletin.

Vulnerability Information

HTML Sanitization Vulnerability - CVE-2012-1858

An information disclosure vulnerability exists in the way that HTML strings
are sanitized. An attacker who successfully exploited this vulnerability could 
perform cross-site scripting attacks and run script in the security context of 
the logged-on user.

XSS scriptresx.ashx Vulnerability - CVE-2012-1859

A cross-site scripting and elevation of privilege vulnerability exists in 
SharePoint allows attacker-controlled JavaScript to run in the context of the 
user clicking a link. This is an elevation of privilege vulnerability as it 
allows an anonymous attacker to potentially issue SharePoint commands in the 
context of an authenticated user on the site.

SharePoint Search Scope Vulnerability - CVE-2012-1860

An information disclosure vulnerability exists in the way that SharePoint 
stores search scopes. An attacker could view or tamper with other users' 
search scopes.

SharePoint Script in Username Vulnerability - CVE-2012-1861

A cross-site scripting vulnerability exists in SharePoint allows 
attacker-controlled JavaScript to run in the context of the user clicking a 
link. This is an elevation of privilege vulnerability as it allows an 
anonymous attacker to potentially issue SharePoint commands in the context of 
an authenticated user.

SharePoint URL Redirection Vulnerability - CVE-2012-1862

A URL redirection vulnerability, which could lead to spoofing and information 
disclosure, exists in SharePoint which could allow an attacker to redirect a 
user to an external URL.

SharePoint Reflected List Parameter Vulnerability - CVE-2012-1863

A cross-site scripting vulnerability exists in SharePoint allows 
attacker-controlled JavaScript to run in the context of the user clicking a 
link. This is an elevation of privilege vulnerability as it allows an 
anonymous attacker to potentially issue SharePoint commands in the context of 
an authenticated user.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT/zE9u4yVqjM2NGpAQJUrhAAnAnFcEroG41JOJgSeDNo7aRz6bbwaN4t
39QbFTCI3Fo5w0oIa3EMp1R2CNJ9bBquKDSufcNdZURfGshnKhh/qva5rg2h6s2m
HLDKcLgWCZDl8Vfv/p6+Z+YzQQWYwHsyCMNtG9Oe+q/pWmdPdYv8a7/XN5tsXU4M
toDXRLtIrkHn2umvQGle95xIUPbi2eEfPnQSxKdZVqOVrsqNSb3B6Slnrkad8uer
+zjUOc/A3u4uTcCJsC/mB/oisWtqUUdHj9IJKg6yOgDSsW43pTGk3AKNW1eWhwHB
GeisvBHyM3GNX+Z2JHWBpYw+HEEqpkwsavH68RXNVJlVZ0qq9j00I3T8dP2IsABO
dKYRvjUeujJVVXbCaFuljaAdprJ2ppivS0T7MBbzkgQ5rPRruDQ61hMumoWOqX1G
WUbbRE72fRR43QSEZ4ctI6eGOUAGIekhquJm31XWZh0lWMbntQfuY4552O6ln6vk
H5Xxk+lLlXYT/rrPN351w2i+EXaUItlOp0GOhw9pYy6FWHYyE0Xrtk9FRD5lfHwg
bve4H0lGVOCJ9XNi1GdVZq4GdfIUSvPW/YsUyg4XeKjosYCv62esrZbNqGhK+7an
CKo4MaalYt58HfuluZP9VWW01Y6iFFqJq1IXELV0RaU9CRY7jhQK5qRsYe5Wznf9
EA7zp9ktFPM=
=j0t/
-----END PGP SIGNATURE-----