Summary
This host is missing an important security update according to Microsoft Bulletin MS13-067.
Impact
Successful exploitation will allow attackers to conduct script insertion attacks, cause a DoS (Denial of Service), and compromise a vulnerable system.
Impact Level: Application
Solution
Run Windows Update and update the listed hotfixes or download and update mentioned hotfixes in the advisory from the below link, http://technet.microsoft.com/en-us/security/bulletin/ms13-067
Insight
Multiple Flaws are due to,
- An error when handling an unassigned workflow can be exploited to cause the W3WP process to stop responding via a specially crafted URL.
- An error related to MAC exists when handling unassigned workflows.
- Input passed via the 'ms-descriptionText > ctl00_PlaceHolderDialogBodySection _PlaceHolderDialogBodyMainSection_ValSummary' parameter related to metadata storage assignment of the BDC permission management within the 'Sharepoint Online Cloud 2013 Service' section is not properly sanitised before being used.
- Certain unspecified input is not properly sanitised before being returned to the user.
- Multiple unspecified errors.
Affected
Microsoft Office Excel Web App 2010 Service Pack 2 and prior Microsoft Office Word Web App 2010 Service Pack 2 and prior
Detection
Get the vulnerable file version and check appropriate patch is applied or not.
References
Severity
Classification
-
CVE CVE-2013-0081, CVE-2013-1315, CVE-2013-1330, CVE-2013-3179, CVE-2013-3180 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities
- Microsoft .NET Framework Multiple Vulnerabilities (2861561)
- Microsoft DirectShow Remote Code Execution Vulnerability (961373)
- Microsoft Active Directory Denial of Service Vulnerability (953235)
- Microsoft .NET Framework Remote Code Execution Vulnerability (2484015)
- Microsoft Active Directory LDAP Remote Code Execution Vulnerability (969805)