PT-2013-2089 · Microsoft · Sharepoint Server 2010 Sp1+2

Published 2013-03-12 · Updated 2018-10-12 · CVE-2013-0085

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server 2010 SP1 Microsoft SharePoint Foundation 2010 SP1

Description A buffer overflow issue allows remote attackers to cause a denial of service by crashing the W3WP process and causing a site outage via a crafted URL. This results in the termination of the W3WP process on affected versions of SharePoint Server, making the SharePoint site and other sites running under that process unavailable until the process is restarted.

Recommendations For Microsoft SharePoint Server 2010 SP1, update to a version that includes the fix for this issue. For Microsoft SharePoint Foundation 2010 SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to crafted URLs to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-0085

Affected Products

Sharepoint Foundation 2010 Sp1

Sharepoint Server 2010 Sp1

Sharepoint Foundation

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-024 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0085 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-0085 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0085 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16414 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-024 · Note
• http://us-cert.gov/ncas/alerts/TA13-071A · Note