Follow me on Twitter @AntonioMaio2

Tuesday, June 14, 2016

Vulnerability: SharePoint 2010
MS16-054 CRITICAL - Addressed in May 2016 CU

In May 2016, Microsoft released a CRITICAL security bulletin related to vulnerabilities in Microsoft SharePoint Server 2010.  The vulnerabilities are identified as Remote Code Execution issues.  Full details can be found here: https://technet.microsoft.com/en-us/library/security/ms16-054.

Versions of Microsoft Office are also affected: 2007, 2010, 2013, 2013RT, 2016 and Mac Versions 2011 & 2016.  Microsoft SharePoint Foundation 2010 is not affected by this issue. 

The following services within the identified SharePoint version(s) are specifically affected:

1. Microsoft SharePoint Server 2010
    • Word Automation Services on Microsoft SharePoint Server 2010 Service Pack 2

    2. Microsoft Office Web Apps Server 2010 Service Pack 2
    • Microsoft Office Web Apps 2010 Service Pack 2

    Background

      According to the official Microsoft Bulletin the following is a summary of the vulnerability:

      This security update resolves vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.  The security update addresses the vulnerabilities by correcting how Office handles objects in memory, and by correcting how the Windows font library handles embedded fonts.

      Security Resources


      • CU UPDATE: a SharePoint Server 2010 Cumulative Update addressing these vulnerabilities and other issues is available for SharePoint Server 2010 through the May 2016 Cumulative Update

      • WORKAROUND: There are no workarounds identified specifically related to Microsoft SharePoint Server 2010.  There are several workarounds related to one of the vulnerabilities identified in the security bulletin which involve preventing users from opening untrusted RTF files by implementing registry customizations.

      • REPORTED EXPLOITS: According to Microsoft, at this time there are no reported exploits that have occurred using these vulnerabilities.

      Vulnerability Details

      Multiple remote code execution vulnerabilities exist in Microsoft Office software when the Office software fails to properly handle objects in memory. There are several vulnerabilities listed in this bulletin, most of which apply only to Microsoft Office.  However, 2 are specifically related to Microsoft SharePoint 2010 and details regarding these are available at the National Vulnerability Database:

      Additional notes from Microsoft:

      An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

      Exploitation of the vulnerabilities requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario an attacker could exploit the vulnerabilities by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerabilities. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince them to open the specially crafted file. The security update addresses the vulnerabilities by correcting how Office handles objects in memory.

      5 comments: