Microsoft SharePoint Server Remote Code Execution Vulnerabilities

Last Update Date: 11 Sep 2013 14:49 Release Date: 11 Sep 2013 3355 Views

RISK: High Risk

TYPE: Servers - Other Servers

SharePoint Denial of Service Vulnerability
A denial of service vulnerability exists in Microsoft SharePoint Server. An attacker who successfully exploited this vulnerability could cause the W3WP process on an affected version of SharePoint Server to stop responding, causing the SharePoint site, and any other sites running under that process, to become unavailable until the process is restarted.
Microsoft Office Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that affected Microsoft Office Services and Web Apps parse content in specially crafted files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
MAC Disabled Vulnerability
Remote code execution vulnerability exists in the way SharePoint Server handles unassigned workflows. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the W3WP service account.
SharePoint XSS Vulnerability
An elevation of privilege vulnerability exists in Microsoft SharePoint Server. An attacker who successfully exploited this vulnerability could allow an attacker to perform cross-site scripting attacks and run script in the security context of the logged-on user.
POST XSS Vulnerability
An elevation of privilege vulnerability exists in Microsoft SharePoint Server. An attacker who successfully exploited this vulnerability could allow an attacker to perform cross-site scripting attacks and run script in the security context of the logged-on user.
Multiple Memory Corruption Vulnerabilities in Word
Remote code execution vulnerabilities exist in the way that affected Microsoft Office software parses specially crafted files. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.