SNS Vulnerability

Microsoft SQL Server Cross-Site Scripting Vulnerability

Description

A vulnerability has been reported in Microsoft SQL Server, which can be exploited by malicious people to conduct cross-site scripting attacks.
Certain unspecified input is not properly sanitised within the SQL Server Report Manager before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Vulnerable Products

Vulnerable Software:
Microsoft SQL Server 2000Microsoft SQL Server 2005Microsoft SQL Server 2005 Express EditionMicrosoft SQL Server 2008Microsoft SQL Server 2012

Solution

Apply patches.Microsoft SQL Server 2000 Reporting Services SP2: http://www.microsoft.com/downloads/details.aspx?familyid=1c70a2cb-e8a9-439f-b34a-7d1641daf325Microsoft SQL Server 2005 Express Edition with Advanced Services SP4: http://www.microsoft.com/downloads/details.aspx?familyid=623841cc-06f7-4475-b2c0-531aed9972a3Microsoft SQL Server 2005 Express Edition with Advanced Services SP4: http://www.microsoft.com/downloads/details.aspx?familyid=16cc7b80-ea4c-4b17-9ac2-250b771a569aMicrosoft SQL Server 2005 for 32-bit Systems SP4: http://www.microsoft.com/downloads/details.aspx?familyid=623841cc-06f7-4475-b2c0-531aed9972a3Microsoft SQL Server 2005 for 32-bit Systems SP4: http://www.microsoft.com/downloads/details.aspx?familyid=16cc7b80-ea4c-4b17-9ac2-250b771a569aMicrosoft SQL Server 2005 for x64-based Systems SP4: http://www.microsoft.com/downloads/details.aspx?familyid=623841cc-06f7-4475-b2c0-531aed9972a3Microsoft SQL Server 2005 for x64-based Systems SP4: http://www.microsoft.com/downloads/details.aspx?familyid=16cc7b80-ea4c-4b17-9ac2-250b771a569aMicrosoft SQL Server 2005 for Itanium-based Systems SP4: http://www.microsoft.com/downloads/details.aspx?familyid=623841cc-06f7-4475-b2c0-531aed9972a3Microsoft SQL Server 2005 for Itanium-based Systems SP4: http://www.microsoft.com/downloads/details.aspx?familyid=16cc7b80-ea4c-4b17-9ac2-250b771a569aMicrosoft SQL Server 2008 for 32-bit Systems SP2: http://www.microsoft.com/downloads/details.aspx?familyid=1bf8dc30-2a90-4196-814c-717ccd74ea13Microsoft SQL Server 2008 for 32-bit Systems SP2: http://www.microsoft.com/downloads/details.aspx?familyid=7d8b1b25-45ad-4f19-ba50-e77debf2b463Microsoft SQL Server 2008 for 32-bit Systems SP3: http://www.microsoft.com/downloads/details.aspx?familyid=04621a83-c2e2-4a60-9198-10104372b120Microsoft SQL Server 2008 for 32-bit Systems SP3: http://www.microsoft.com/downloads/details.aspx?familyid=4c4597d2-dea0-49b9-a5a9-a7771a3d64c0Microsoft SQL Server 2008 for x64-based Systems SP2: http://www.microsoft.com/downloads/details.aspx?familyid=1bf8dc30-2a90-4196-814c-717ccd74ea13Microsoft SQL Server 2008 for x64-based Systems SP2: http://www.microsoft.com/downloads/details.aspx?familyid=7d8b1b25-45ad-4f19-ba50-e77debf2b463Microsoft SQL Server 2008 for x64-based Systems SP3: http://www.microsoft.com/downloads/details.aspx?familyid=04621a83-c2e2-4a60-9198-10104372b120Microsoft SQL Server 2008 for x64-based Systems SP3: http://www.microsoft.com/downloads/details.aspx?familyid=4c4597d2-dea0-49b9-a5a9-a7771a3d64c0Microsoft SQL Server 2008 for Itanium-based Systems SP2: http://www.microsoft.com/downloads/details.aspx?familyid=1bf8dc30-2a90-4196-814c-717ccd74ea13Microsoft SQL Server 2008 for Itanium-based Systems SP2: http://www.microsoft.com/downloads/details.aspx?familyid=7d8b1b25-45ad-4f19-ba50-e77debf2b463Microsoft SQL Server 2008 for Itanium-based Systems SP3: http://www.microsoft.com/downloads/details.aspx?familyid=04621a83-c2e2-4a60-9198-10104372b120Microsoft SQL Server 2008 for Itanium-based Systems SP3: http://www.microsoft.com/downloads/details.aspx?familyid=4c4597d2-dea0-49b9-a5a9-a7771a3d64c0Microsoft SQL Server 2008 R2 for 32-bit Systems SP1: http://www.microsoft.com/downloads/details.aspx?familyid=215a9184-71c5-41e6-b4d5-03602182a88fMicrosoft SQL Server 2008 R2 for 32-bit Systems SP1: http://www.microsoft.com/downloads/details.aspx?familyid=cdc4fc03-dfba-41d4-b651-d7967a067eeaMicrosoft SQL Server 2008 R2 for x64-based Systems SP1: http://www.microsoft.com/downloads/details.aspx?familyid=215a9184-71c5-41e6-b4d5-03602182a88fMicrosoft SQL Server 2008 R2 for x64-based Systems SP1: http://www.microsoft.com/downloads/details.aspx?familyid=cdc4fc03-dfba-41d4-b651-d7967a067eeaMicrosoft SQL Server 2008 R2 for Itanium-based Systems SP1: http://www.microsoft.com/downloads/details.aspx?familyid=215a9184-71c5-41e6-b4d5-03602182a88fMicrosoft SQL Server 2008 R2 for Itanium-based Systems SP1: http://www.microsoft.com/downloads/details.aspx?familyid=cdc4fc03-dfba-41d4-b651-d7967a067eeaMicrosoft SQL Server 2012 for 32-bit Systems: http://www.microsoft.com/downloads/details.aspx?familyid=e79b4e5b-1549-4e76-afef-b771b432365bMicrosoft SQL Server 2012 for 32-bit Systems: http://www.microsoft.com/downloads/details.aspx?familyid=ebfcb341-e240-4107-92f1-ab75cc28151aMicrosoft SQL Server 2012 for x64-based Systems: http://www.microsoft.com/downloads/details.aspx?familyid=e79b4e5b-1549-4e76-afef-b771b432365bMicrosoft SQL Server 2012 for x64-based Systems: http://www.microsoft.com/downloads/details.aspx?familyid=ebfcb341-e240-4107-92f1-ab75cc28151a

CVE

CVE-2012-2552

References

MS12-070 (KB983814
KB2716429
KB2716427
KB2716434
KB2716433
KB2716436
KB2716435
KB2716440
KB2716439
KB2716442
KB2716441):
http://technet.microsoft.com/en-us/security/bulletin/ms12-070

Vulnerability Manager Detection

No

IPS Protection

ASQ Engine alarm	Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL	3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL	3.2.0
XSS - Phishing : suspicious 'div' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL	3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL	3.2.0
XSS - Phishing : suspicious 'a' tag found in URL	3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL	3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL	3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL	3.2.0
XSS - Phishing : suspicious 'form' tag found in URL	3.2.0
XSS - Prevention - GET : javascript code found in URL	3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL	3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL	3.2.0
XSS - Phishing : suspicious 'link' tag found in URL	3.2.0
XSS - Prevention - GET : 'script' tag found in URL	3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL	3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL	3.2.0
SQL injection Prevention - GET : Evasion attempt with CAST and EXEC statements	5.0.0

Risk level

Low

Vulnerability First Public Report Date

2012-10-09

Target Type

Server

Possible exploit

Remote