Microsoft FrontPage Server Extensions HTML cross-site scripting
| fpse-html-xss (25537) |  Medium Risk |
Description:
Microsoft FrontPage Server Extensions (FPSE) is vulnerable to cross-site scripting, caused by improper validation of user-supplied input in the form of HTML. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site.
Platforms Affected:
- Microsoft, FrontPage Server Extensions 2002
- Microsoft, SharePoint Team Services
- Microsoft, Windows 2000 SP4
- Microsoft, Windows 2003 Server x64
- Microsoft, Windows 2003 Server Itanium
- Microsoft, Windows 2003 Server SP1 Itanium
- Microsoft, Windows 2003 Server SP1
- Microsoft, Windows XP SP2
- Microsoft, Windows XP SP1
- Microsoft, Windows XP Professional x64
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS06-017. See References.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Wed Apr 12 2006 - 16:32:16 CDT, Vulnerability in Microsoft FrontPage Server Extensions Could Allow Cross-Site Scripting at http://archives.neohapsis.com/archives/bugtraq/2006-04/0235.html.
- Microsoft Security Bulletin MS06-017, Vulnerability Using Microsoft Front Page Server Extensions Could Allow Cross Site Scripting (917627) at http://www.microsoft.com/technet/security/bulletin/ms06-017.mspx.
- BID-17452: Microsoft FrontPage Server Extensions Cross-Site Scripting Vulnerability
- CVE-2006-0015: Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack to execute arbitrary programs or create new accounts, via the (1) operation, (2) command, and (3) name parameters.
- SA19623: Microsoft FrontPage Server Extensions Cross-Site Scripting
- SECTRACK ID: 1015895: Microsoft SharePoint Team Services Input Validation Holes Permit Cross-Site Scripting Attacks
- SECTRACK ID: 1015896: Microsoft FrontPage Server Extensions Input Validation Holes Permit Cross-Site Scripting Attacks
- VUPEN/ADV-2006-1322: Microsoft FrontPage Server Extensions Cross Site Scripting Issue (MS06-017)
Reported:
Apr 11, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net