PT-2013-3086 · Microsoft · Sharepoint Server+4

Published 2013-09-11 · Updated 2018-10-12 · CVE-2013-1330

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Portal Server versions 2003 SP3 through 2010 SP2 SharePoint Server versions 2007 SP3 through 2010 SP2 Office Web Apps version 2010

Description A remote code execution issue exists due to the improper setting of the EnableViewStateMac attribute, allowing attackers to execute arbitrary code by leveraging an unassigned workflow. This issue can be exploited by remote attackers, potentially leading to the execution of arbitrary code in the context of the W3WP service account.

Recommendations For Microsoft SharePoint Portal Server 2003 SP3, consider setting the EnableViewStateMac attribute to prevent exploitation. For SharePoint Server 2007 SP3 and 2010 SP1 and SP2, set the EnableViewStateMac attribute to mitigate the risk. For Office Web Apps 2010, set the EnableViewStateMac attribute to prevent arbitrary code execution. As a temporary workaround, consider restricting access to unassigned workflows until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1330

Affected Products

Exchange Server

Sharepoint Portal Server

Office Web Apps

Sharepoint Server

Sharepoint Foundation

References · 9

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-105 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1330 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-1330 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067 · Vendor Advisory
• http://technet.microsoft.com/en-us/security/bulletin/ms13-067 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19040 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms13-105 · Note
• http://us-cert.gov/ncas/alerts/TA13-253A · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1330 · Note