Signature Detail

HTTP: Internet Explorer ToStatic Cross Site Scripting

This signature detects attempts to exploit a known vulnerability in Microsoft Internet Explorer. A successful attack can result in unauthorized information disclosure.

Extended Description

Internet Explorer 8 is prone to a security-bypass weakness. Internet Explorer 8 includes a method designed to sanitize executable script constructs from HTML. Attackers can bypass this protection, allowing script code to execute on the client, for example in a 'postMessage' call. Attackers can leverage this issue to obtain sensitive information or potentially launch cross-site scripting attacks on unsuspecting users of targeted sites. Other attacks may also be possible.

Affected Products

• Avaya Aura Conferencing 6.0 Standard
• Avaya Aura Conferencing Standard
• Avaya CallPilot
• Avaya Communication Server 1000 Telephony Manager
• Avaya Meeting Exchange - Client Registration Server
• Avaya Meeting Exchange - Recording Server
• Avaya Meeting Exchange - Streaming Server
• Avaya Meeting Exchange - Web Conferencing Server
• Avaya Meeting Exchange - Webportal
• Avaya Messaging Application Server 4
• Avaya Messaging Application Server 5
• Avaya Messaging Application Server MM 1.1
• Avaya Messaging Application Server MM 2.0
• Avaya Messaging Application Server MM 3.0
• Avaya Messaging Application Server MM 3.1
• Avaya Messaging Application Server
• Microsoft Groove Server 2010
• Microsoft Internet Explorer 8
• Microsoft Office Web Apps
• Microsoft Office Web Apps
• Microsoft SharePoint Foundation 2010
• Microsoft SharePoint Server 2007 SP1
• Microsoft SharePoint Server 2007 SP2
• Microsoft SharePoint Server 2007
• Microsoft SharePoint Server 2007 Enterprise Edition
• Microsoft SharePoint Server 2007 Standard Edition
• Microsoft SharePoint Server 2007 x64 SP1
• Microsoft SharePoint Server 2007 x64 SP2
• Microsoft SharePoint Server 2007 x64
• Microsoft SharePoint Services 3.0 SP1
• Microsoft SharePoint Services 3.0 SP2
• Microsoft SharePoint Services 64-bit 3.0
• Microsoft SharePoint Services 64-bit 3.0
• Microsoft SharePoint Services 64-bit 3.0 SP1
• Microsoft SharePoint Services 64-bit 3.0 SP2

References

• BugTraq: 42467
• CVE: CVE-2010-3324
• URL: http://www.wooyun.org/bug.php?action=view&id=189