[NT] Microsoft SharePoint Portal and Team Services Vulnerability

• Previous message: SecuriTeam: "[UNIX] HPUX dtmailpr Buffer Overflow Vulnerability (DISPLAY)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 23 Nov 2003 11:13:52 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Microsoft SharePoint Portal and Team Services Vulnerability
------------------------------------------------------------------------

SUMMARY

A vulnerability in the way Microsoft's SharePoint Portal and Team Services
works, allows remote attackers to bypass the authentication mechanism, by
disabling the JavaScript support when viewing that page (or restricting
access to the password protected area). Disabling JavaScript doesn't not
affect the ability to control the products.

DETAILS

There is a bug in how the authentication works with the web-based
administration page. This page resides, in the web servers with
SharePoint, in http://www.example.com/_layouts/settings.htm or
http://www.example.com/some_directory/_layouts/settings.htm.

This page is usually protected by NT Basic or NTLM authentication via a
JavaScript request to a protected area.

The trick to see this page consist in modifying the IE security slidebar,
in Security tab, to HIGH, or by disabling JavaScript. The process is as
follow:
 - Check Security: Tools -> Options -> Security -> Security Medium
 - Browse to /_layouts/settings.htm page.
 - NT Basic or NTLM Window is shown
 - Click on Cancel -> You see "You are not authorized to view this page"
 - Change Security to HIGH and press F5 for refresh
 - The page is shown with some error and incomplete, but we don't need
user or password to see it and some links are fully functional

ADDITIONAL INFORMATION

The information has been provided by <mailto:arkanian@hacker.am>
arkanian.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] HPUX dtmailpr Buffer Overflow Vulnerability (DISPLAY)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NEWS] SpiDynamics WebInspect Keeps Track of Its Users (Trial License)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... WebInspect, S.P.I.
  Dynamic's premier product, is a network-based web ... We make no effort to hide that this remote
  authentication is done. ... (Securiteam)
• [NT] DoS and Directory Traversal Vulnerabilities in WebServer 4 Everyone
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... requests and to allow attackers
  to download files that reside the outside ... (Securiteam)
• [UNIX] Multiple Security Issues in Geeklog (XSS, SQL Inject)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... the vulnerabilities would
  allow a remote attacker to ... SQL Injection: ... (Securiteam)
• [NT] WebEasyMail Multiple Security Vulnerabilities (User disclosure, DoS)
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... to reveal which username
  are valid on the remote host. ... (Securiteam)
• [UNIX] DCP-Portal Cross-Site Scripting
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... A security vulnerability
  in the product allows ... the members page, this CSS vulnerability will take effect. ...
  (Securiteam)