• 17 minutes to read

Security Bulletin

Microsoft Security Bulletin MS13-035 - Important

Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege (2821818)

Published: April 09, 2013

Version: 1.0

General Information

Executive Summary

This security update resolves a privately reported vulnerability in Microsoft Office. The vulnerability could allow elevation of privilege if an attacker sends specially crafted content to a user.

This security update is rated Important for supported editions of Microsoft SharePoint Server 2010, Microsoft Groove Server 2010, Microsoft SharePoint Foundation 2010, and Microsoft Office Web Apps 2010. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by modifying the way that HTML strings are sanitized. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection under the next section, Vulnerability Information.

Recommendation. Customers can configure automatic updating to check online for updates from Microsoft Update by using the Microsoft Update service. Customers who have automatic updating enabled and configured to check online for updates from Microsoft Update typically will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates from Microsoft Update and install this update manually. For information about specific configuration options in automatic updating in supported editions of Windows XP and Windows Server 2003, see Microsoft Knowledge Base Article 294871. For information about automatic updating in supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, see Understanding Windows automatic updating.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update at the earliest opportunity using update management software, or by checking for updates using the Microsoft Update service.

See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.

Knowledge Base Article

Knowledge Base Article 2821818
File information Yes
SHA1/SHA2 hashes Yes
Known issues Yes

Affected and Non-Affected Software

The following software have been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Affected Software

Microsoft Office

Software Maximum Security Impact Aggregate Severity Rating Updates Replaced
Microsoft InfoPath 2010 Service Pack 1 (32-bit editions)
(2687422)		 None No severity rating[1] 2687436 in MS12-066
Microsoft InfoPath 2010 Service Pack 1 (32-bit editions)
(2760406)		 None No severity rating[1] 2687417 in MS12-066
Microsoft InfoPath 2010 Service Pack 1 (64-bit editions)
(2687422)		 None No severity rating[1] 2687436 in MS12-066
Microsoft InfoPath 2010 Service Pack 1 (64-bit editions)
(2760406)		 None No severity rating[1] 2687417 in MS12-066
[1]Severity ratings do not apply to this update for the specified software because the known attack vectors for the vulnerability are blocked. **Microsoft Server Software**

Software Component Maximum Security Impact Aggregate Severity Rating Updates Replaced
Microsoft SharePoint Server
Microsoft SharePoint Server 2010 Service Pack 1 [Microsoft SharePoint Server 2010 Service Pack 1 (wosrv)](http://www.microsoft.com/downloads/details.aspx?familyid=6c7d007f-5c8d-464c-af04-4e7800a2e2a6)[1] (2687421) Elevation of Privilege Important 2687435 in [MS12-066](http://go.microsoft.com/fwlink/?linkid=260957)
Microsoft SharePoint Server 2010 Service Pack 1 [Microsoft SharePoint Server 2010 Service Pack 1 (coreserver)](http://www.microsoft.com/downloads/details.aspx?familyid=c59c0d25-8d6c-4dda-a06b-e42891a9ddae)[1] (2760408) Elevation of Privilege Important 2589280 in [MS12-066](http://go.microsoft.com/fwlink/?linkid=260957)
Microsoft Groove Server
[Microsoft Groove Server 2010 Service Pack 1](http://www.microsoft.com/downloads/details.aspx?familyid=d63ee461-b823-4eb1-9e6d-82f380627fb5) (2687424) Not applicable Elevation of Privilege Important 2687402 in [MS12-066](http://go.microsoft.com/fwlink/?linkid=260957)
Microsoft SharePoint Foundation
[Microsoft SharePoint Foundation 2010 Service Pack 1](http://www.microsoft.com/downloads/details.aspx?familyid=ac805c46-8661-4e99-84da-c395dc05beb0) (2810059) Not applicable Elevation of Privilege Important 2687434 in [MS12-066](http://go.microsoft.com/fwlink/?linkid=260957)
[1]For supported editions of Microsoft SharePoint Server 2010, in addition to the security update packages for Microsoft SharePoint 2010 (2687421 and 2760408), customers also need to install the security update for Microsoft SharePoint Foundation 2010 (2810059) to be protected from the vulnerability described in this bulletin.

Microsoft Office Web Apps

Software Component Maximum Security Impact Aggregate Severity Rating Updates Replaced
Microsoft Office Web Apps 2010 Service Pack 1
(2760777)		 Not applicable Elevation of Privilege Important 2687401 in MS12-066
**Non-Affected Software** | Office and Other Software | |---------------------------------------------------------------------------| | Microsoft Groove 2007 Service Pack 2 | | Microsoft Groove 2007 Service Pack 3 | | Microsoft Groove Server 2007 Service Pack 2 | | Microsoft Groove Server 2007 Service Pack 3 | | Microsoft Groove Server 2013 | | Microsoft InfoPath 2003 Service Pack 3 | | Microsoft InfoPath 2007 Service Pack 2 | | Microsoft InfoPath 2007 Service Pack 3 | | Microsoft InfoPath 2013 | | Microsoft Speech Server 2004 | | Microsoft Speech Server 2004 R2 | | Microsoft Live Communications Server 2003 | | Microsoft Live Communications Server 2005 Service Pack 1 | | Microsoft SharePoint Server 2007 Service Pack 2 (32-bit editions) | | Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions) | | Microsoft SharePoint Server 2007 Service Pack 2 (64-bit editions) | | Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions) | | Microsoft SharePoint Server 2013 | | Microsoft SharePoint Foundation 2013 | | Microsoft SharePoint Portal Server 2003 Service Pack 3 (32-bit editions) | | Microsoft SharePoint Portal Server 2003 Service Pack 3 (64-bit editions) | | Microsoft Windows SharePoint Services 2.0 (32-bit editions) | | Microsoft Windows SharePoint Services 2.0 (64-bit editions) | | Microsoft Windows SharePoint Services 3.0 Service Pack 2 (32-bit version) | | Microsoft Windows SharePoint Services 3.0 Service Pack 2 (64-bit version) | | Microsoft Windows SharePoint Services 3.0 Service Pack 3 (32-bit version) | | Microsoft Windows SharePoint Services 3.0 Service Pack 3 (64-bit version) | | Microsoft SharePoint Workspace 2010 Service Pack 1 (32-bit editions) | | Microsoft SharePoint Workspace 2010 Service Pack 1 (64-bit editions) | | Microsoft SharePoint Workspace 2013 (32-bit editions) | | Microsoft SharePoint Workspace 2013 (64-bit editions) | Update FAQ ---------- **Why** **is there no severity rating forInfoPath 2010** **Service Pack 1** **and why am I being offered updates for it?**  Although the attack vector for CVE-2013-1289 is actualized only through affected versions of Microsoft SharePoint Server 2010, Microsoft Groove Server 2010, Microsoft SharePoint Foundation 2010, and Microsoft Office Web Apps 2010, the vulnerable code exists in a shared component of Microsoft Office that also resides in Microsoft InfoPath 2010 Service Pack 1. However, because InfoPath does not access the vulnerable code, it is not ultimately affected by this vulnerability (hence, there is no severity rating for it). The update is being offered for it to ensure that all products that contain the vulnerable code are using the same version of the shared component. **A Microsoft Office component discussed in this bulletin is part of the Microsoft Office Suite that I have installed on my system; however, I did not choose to install this specific component. Will I be offered this update?**  Yes, if the component discussed in this bulletin was delivered with the version of the Microsoft Office Suite installed on your system, the system will be offered updates for it whether the component is installed or not. The detection logic used to scan for affected systems is designed to check for updates for all components that were delivered with the particular Microsoft Office Suite and to offer the updates to a system. Users who choose not to apply an update for a component that is not installed, but is delivered with their version of the Microsoft Office Suite, will not increase the security risk of that system. On the other hand, users who do choose to install the update will not have a negative impact on the security or performance of a system. **Does the offer to update a non-vulnerable version of Microsoft Office constitute an issue in the Microsoft update mechanism?**  No, the update mechanism is functioning correctly in that it detects a lower version of the files on the system than in the update package and thus, offers the update. **Why are multiple update packages available for some affected software?** The updates required to address the vulnerabilities described in this bulletin are offered across different updates packages as indicated in the **Affected Software** table due to the componentized servicing model for Microsoft Office and Microsoft SharePoint Server software. **There are multiple update packages available for some affected software. Do I need to install all of the updates listed in the Affected Software table for the software?** Yes. Customers should apply all updates offered for the software installed on their systems. For administrators and enterprise installations, or end users who want to install this security update manually, depending on their configuration of Microsoft Office SharePoint Server, not all the server-package updates listed in this bulletin may apply. For more information on the applicability of these server-package updates in a SharePoint environment, see [Microsoft Knowledge Base Article 2741517](http://support.microsoft.com/kb/2741517). **Do I need to install these security updates in a particular sequence?** No. Multiple updates for one version of Microsoft Office or Microsoft SharePoint Server software can be applied in any sequence. **What is Microsoft Groove Server 2010?** Microsoft Groove Server 2010 provides comprehensive services for managing Microsoft SharePoint Workspace. Groove Server 2010 contains two components: Groove Server 2010 Manager and Groove Server 2010 Relay, each of which runs on a Windows server on an enterprise network. **What is Microsoft SharePoint Foundation 2010?** [Microsoft SharePoint Foundation 2010](http://technet.microsoft.com/sharepoint/ee263910.aspx) is the new version of Microsoft Windows SharePoint Services. It is the essential solution for organizations that need a secure, manageable, web-based collaboration platform. SharePoint helps teams stay connected and productive by providing easy access to the people, documents, and information that they need to make well-informed decisions and get work done. Use SharePoint Foundation to coordinate schedules, organize documents, and participate in discussions through team workspaces, blogs, wikis, and document libraries on the platform that is the underlying infrastructure for SharePoint Server. **I am using an older release of the software discussed in this security bulletin. What should I do?**  The affected software listed in this bulletin have been tested to determine which releases are affected. Other releases are past their support life cycle. For more information about the product lifecycle, see the [Microsoft Support Lifecycle](http://go.microsoft.com/fwlink/?linkid=21742) website. It should be a priority for customers who have older releases of the software to migrate to supported releases to prevent potential exposure to vulnerabilities. To determine the support lifecycle for your software release, see [Select a Product for Lifecycle Information](http://go.microsoft.com/fwlink/?linkid=169555). For more information about service packs for these software releases, see [Service Pack Lifecycle Support Policy](http://go.microsoft.com/fwlink/?linkid=89213). Customers who require custom support for older software must contact their Microsoft account team representative, their Technical Account Manager, or the appropriate Microsoft partner representative for custom support options. Customers without an Alliance, Premier, or Authorized Contract can contact their local Microsoft sales office. For contact information, see the [Microsoft Worldwide Information](http://go.microsoft.com/fwlink/?linkid=33329) website, select the country in the Contact Information list, and then click **Go** to see a list of telephone numbers. When you call, ask to speak with the local Premier Support sales manager. For more information, see the [Microsoft Support Lifecycle Policy FAQ](http://go.microsoft.com/fwlink/?linkid=169557). ### Vulnerability Information Severity Ratings and Vulnerability Identifiers ---------------------------------------------- The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the [April bulletin summary](http://technet.microsoft.com/security/bulletin/ms13-apr). For more information, see [Microsoft Exploitability Index](http://technet.microsoft.com/security/cc998259).

Vulnerability Severity Rating and Maximum Security Impact by Affected Software
Affected Software HTML Sanitization Vulnerability - CVE-2013-1289 Aggregate Severity Rating
Microsoft Office
Microsoft InfoPath 2010 Service Pack 1 (32-bit editions) **No severity rating**[1] **No severity rating**
Microsoft InfoPath 2010 Service Pack 1 (64-bit editions) **No severity rating**[1] **No severity rating**
Microsoft SharePoint Server
Microsoft SharePoint Server 2010 Service Pack 1 **Important** Elevation of Privilege **Important**
Microsoft Groove Server
Microsoft Groove Server 2010 Service Pack 1 **Important** Elevation of Privilege **Important**
Microsoft SharePoint Foundation
Microsoft SharePoint Foundation 2010 Service Pack 1 **Important** Elevation of Privilege **Important**
Microsoft Offices Web Apps
Microsoft Office Web Apps 2010 Service Pack 1 **Important** Elevation of Privilege **Important**
[1]Severity ratings do not apply to this update for the specified software because the known attack vectors for the vulnerability are blocked.

HTML Sanitization Vulnerability - CVE-2013-1289

An elevation of privilege vulnerability exists in the way that HTML strings are sanitized. An attacker who successfully exploited this vulnerability could perform cross-site scripting attacks on affected systems and run script in the security context of the current user.

To view this vulnerability as a standard entry in the Common Vulnerabilities and Exposures list, see CVE-2013-1289.

Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

FAQ

What is the scope of the vulnerability?
This is an elevation of privilege vulnerability.

What causes the vulnerability?
The vulnerability is caused by the way that HTML strings are sanitized.

What is HTML sanitization?
HTML sanitization is a process that restricts HTML to elements that can be safely displayed in a browser.

What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could read content that the attacker is not authorized to read or use the victim's identity to take actions on the targeted site or application.

How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker would have to convince a user to view specially crafted SharePoint content, which then runs a script in the context of the user.

In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted website. Instead, an attacker would have to convince them to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker's website.

What systems are primarily at risk from the vulnerability?
Systems where users connect to a SharePoint server are primarily at risk from this vulnerability.

What does the update do?
The update addresses the vulnerability by modifying the way that HTML strings are sanitized.

When this security bulletin was issued, had this vulnerability been publicly disclosed?
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited?
Yes. Microsoft is aware of limited, targeted attacks attempting to exploit the vulnerability.

Update Information

Detection and Deployment Tools and Guidance

Several resources are available to help administrators deploy security updates. 

  • Microsoft Baseline Security Analyzer (MBSA) lets administrators scan local and remote systems for missing security updates and common security misconfigurations. 
  • Windows Server Update Services (WSUS), Systems Management Server (SMS), and System Center Configuration Manager (SCCM) help administrators distribute security updates. 
  • The Update Compatibility Evaluator components included with Application Compatibility Toolkit aid in streamlining the testing and validation of Windows updates against installed applications. 

For more information about these tools and guidance in deploying security updates across networks, see Security Tools for IT Pros. 

Security Update Deployment

Affected Software

For information about the specific security update for your affected software, click the appropriate link:

InfoPath 2010 (all editions)

Reference Table

The following table contains the security update information for this software.

Security update file name For all supported 32-bit editions of InfoPath 2010:
infopath2010-kb2687422-fullfile-x86-glb.exe
ipeditor2010-kb2760406-fullfile-x86-glb.exe
  For all supported x64-based editions of InfoPath 2010:
infopath2010-kb2687422-fullfile-x64-glb.exe
ipeditor2010-kb2760406-fullfile-x64-glb.exe
Installation switches See Microsoft Knowledge Base Article 912203
Restart Requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.
Removal Information Use Add or Remove Programs item in Control Panel.
File Information See Microsoft Knowledge Base Article 2687422 and Microsoft Knowledge Base Article 2760406
Registry Key Verification Not applicable
#### SharePoint Server 2010 (all editions) **Reference Table** The following table contains the security update information for this software.

Security update file name For all supported editions of Microsoft SharePoint Server 2010:
wosrv2010-kb2687421-fullfile-x64-glb.exe
coreserver2010-kb2760408-fullfile-x64-glb.exe
Installation switches See Microsoft Knowledge Base Article 912203
Restart Requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.
Removal Information This security update cannot be removed.
File Information See Microsoft Knowledge Base Article 2687421 and Microsoft Knowledge Base Article 2760408
Registry Key Verification Not applicable
#### Groove Server 2010 (all editions) **Reference Table** The following table contains the security update information for this software.

Security update file name For all supported editions of Microsoft Groove Server 2010:
emsgrs2010-kb2687424-fullfile-x64-glb.exe
Installation switches See Microsoft Knowledge Base Article 912203
Restart Requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.
Removal Information This security update cannot be removed.
File Information See Microsoft Knowledge Base Article 2687424
Registry Key Verification Not applicable
#### Microsoft SharePoint Foundation 2010 (all versions) **Reference Table** The following table contains the security update information for this software.

Security update file name For Microsoft SharePoint Foundation 2010 Service Pack 1:
wss2010-kb2810059-fullfile-x64-glb.exe
Installation switches See Microsoft Knowledge Base Article 912203
Restart Requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.
Removal Information This security update cannot be removed.
File Information See Microsoft Knowledge Base Article 2810059
Registry Key Verification Not applicable
#### Office Web Apps 2010 (all versions) **Reference Table** The following table contains the security update information for this software.

Security update file name For Office Web Apps 2010 Service Pack 1:
wac2010-kb2760777-fullfile-x64-glb.exe
Installation switches See Microsoft Knowledge Base Article 912203
Restart Requirement In some cases, this update does not require a restart. If the required files are being used, this update will require a restart. If this behavior occurs, a message appears that advises you to restart.

To help reduce the chance that a restart will be required, stop all affected services and close all applications that may use the affected files prior to installing the security update. For more information about the reasons why you may be prompted to restart, see Microsoft Knowledge Base Article 887012.
Removal Information This security update cannot be removed.
File Information See Microsoft Knowledge Base Article 2760777
Registry Key Verification Not applicable
### Other Information #### Acknowledgments Microsoft [thanks](http://go.microsoft.com/fwlink/?linkid=21127) the following for working with us to help protect customers: - Drew Hintz and Andrew Lyons of [Google Security Team](http://www.google.com/) for reporting the HTML Sanitization Vulnerability (CVE-2013-1289) #### Microsoft Active Protections Program (MAPP) To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please go to the active protections websites provided by program partners, listed in [Microsoft Active Protections Program (MAPP) Partners](http://go.microsoft.com/fwlink/?linkid=215201). #### Support **How to obtain help and support for this security update** - Help installing updates: [Support for Microsoft Update](http://support.microsoft.com/ph/6527) - Security solutions for IT professionals: [TechNet Security Troubleshooting and Support](http://technet.microsoft.com/security/bb980617) - Help protect your computer that is running Windows from viruses and malware: [Virus Solution and Security Center](http://support.microsoft.com/contactus/cu_sc_virsec_master) - Local support according to your country: [International Support](http://support.microsoft.com/common/international.aspx) #### Disclaimer The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. #### Revisions - V1.0 (April 9, 2013): Bulletin published. *Built at 2014-04-18T13:49:36Z-07:00*