ID CVE-2010-1264
Summary Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x32
    cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x32
  • cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x64
    cpe:2.3:a:microsoft:sharepoint_services:3.0:sp1:x64
  • cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32
    cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x32
  • cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x64
    cpe:2.3:a:microsoft:sharepoint_services:3.0:sp2:x64
CVSS
Base: 4.0 (as of 09-06-2010 - 13:10)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
msbulletin via4
bulletin_id MS10-039
bulletin_url
date 2010-06-08T00:00:00
impact Elevation of Privilege
knowledgebase_id 2028554
knowledgebase_url
severity Important
title Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege
nessus via4
  • NASL family CGI abuses
    NASL id SHAREPOINT_HELP_DOS.NASL
    description The version of Microsoft SharePoint Services running on the remote host has a denial of service vulnerability. Sending invalid data to the 'tid' parameter of 'help.aspx' can cause the application to hang. A remote attacker could exploit this by sending malicious requests, causing SharePoint to hang temporarily, resulting in a denial of service. Repeatedly sending malicious requests can cause SharePoint's application pool to stop, which would require a manual restart of the application pool.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 47579
    published 2010-07-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=47579
    title Microsoft SharePoint Service Help.aspx 'tid' Parameter DoS
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS10-039.NASL
    description The remote Windows host is running a version of InfoPath, SharePoint Server, or SharePoint Services with the following vulnerabilities : - A cross-site scripting vulnerability in Help.aspx. (CVE-2010-0817) - An information disclosure vulnerability in the toStaticHTML() API. (CVE-2010-1257) - A denial of service vulnerability, triggered by sending specially crafted requests to the help page. (CVE-2010-1264)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 46846
    published 2010-06-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=46846
    title MS10-039: Vulnerabilities in Microsoft SharePoint Could Allow Elevation of Privilege (2028554)
oval via4
accepted 2013-11-11T04:02:58.962-05:00
class vulnerability
contributors
  • name Dragos Prisaca
    organization Symantec Corporation
  • name Dragos Prisaca
    organization G2, Inc.
  • name Chandan S
    organization SecPod Technologies
definition_extensions
  • comment Microsoft Windows Server 2003 (32-bit) is installed
    oval oval:org.mitre.oval:def:1870
  • comment Microsoft Windows Server 2003 (x64) is installed
    oval oval:org.mitre.oval:def:730
description Unspecified vulnerability in Microsoft Windows SharePoint Services 3.0 SP1 and SP2 allows remote attackers to cause a denial of service (hang) via crafted requests to the Help page that cause repeated restarts of the application pool, aka "Sharepoint Help Page Denial of Service Vulnerability."
family windows
id oval:org.mitre.oval:def:7241
status accepted
submitted 2010-06-08T13:00:00
title Sharepoint Help Page Denial of Service Vulnerability
version 24
refmap via4
bid 40559
cert TA10-159B
ms MS10-039
Last major update 21-08-2010 - 01:40
Published 08-06-2010 - 16:30
Last modified 12-10-2018 - 17:57
Back to Top