Oval Definition:oval:org.mitre.oval:def:12664
Revision Date:2015-06-15Version:57
Title:XML External Entities Resolution Vulnerability
Description:The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) file, aka "XML External Entities Resolution Vulnerability."
Family:windowsClass:vulnerability
Status:ACCEPTEDReference(s):CVE-2011-1280
Platform(s):Microsoft Windows 2000
Microsoft Windows 7
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Vista
Microsoft Windows XP
Product(s):Microsoft Office InfoPath 2007
Microsoft Office InfoPath 2010
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition
Microsoft SQL Server 2008
Microsoft SQL Server 2008 R2
Microsoft SQL Server Management Studio Express (SSMSE) 2005
Microsoft Visual Studio 2005
Microsoft Visual Studio 2008
Microsoft Visual Studio 2010
Definition Synopsis
  • Vulnerable Microsoft Office InfoPath 2007
  • Microsoft InfoPath 2007 is installed
  • AND NOT KB2510061 is installed
  • Vulnerable Microsoft Office InfoPath 2010
  • Microsoft InfoPath 2010 is installed
  • AND NOT Check if Microsoft Office 2010 SP1 or greater is installed
  • AND NOT KB2510065 is installed
  • OR SQL Server 2005 Service Pack 3
  • Microsoft SQL Server 2005
  • Microsoft SQL Server 2005
  • Microsoft SQL Server 2005 is installed
  • AND HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\90\DTS\Setup\\SP equals 3
  • OR Microsoft SQL Server 2005 SP3 is installed
  • AND SQL 2005
  • Microsoft SQL Server 2005 SP3 Database Engine
  • The version of Sqlservr.exe is less than 2005.90.4060.0
  • OR QFE
  • The version of Sqlservr.exe is greater than or equal to 2005.90.4207.0
  • AND The version of Sqlservr.exe is less than 2005.90.4340.0
  • OR Microsoft SQL Server 2005 SP3 Analysis Services
  • Microsoft SQL Server 2005 Analysis Services is installed
  • AND GDR or QFE
  • The version of Msmdsrv.exe is less than 9.0.4060.0
  • OR Microsoft SQL Server 2005 SP3 Notification Services
  • Microsoft SQL Server 2005 Notification Services is installed
  • AND GDR or QFE
  • The version of Nsservice.exe is less than 9.0.4060.0
  • OR Microsoft SQL Server 2005 SP3 Reporting Services
  • Microsoft SQL Server 2005 Reporting Services is installed
  • AND GDR or QFE
  • The version of Reportingservicesservice.exe is less than 9.0.4060.0
  • OR Microsoft SQL Server 2005 SP3 Integration Services
  • Microsoft SQL Server 2005 Integration Services is installed
  • AND GDR or QFE
  • The version of Msdtssrvr.exe is less than 9.0.4060.0
  • OR Microsoft SQL Server 2005 SP3 Tools
  • Microsoft SQL Server 2005 Tools is installed
  • AND GDR or QFE
  • The version of Sqlwb.exe is less than 2005.90.4060.0
  • OR SQL Server 2005 Service Pack 4
  • SQL 2005 SP4
  • SQL 2005
  • Microsoft SQL Server 2005 is installed
  • AND HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\90\DTS\Setup\\SP equals 4
  • OR Microsoft SQL Server 2005 SP4 is installed
  • AND SQL 2005 Components
  • Microsoft SQL Server 2005 SP4 Database Engine
  • The version of Sqlservr.exe is less than 2005.90.5057.0
  • OR QFE
  • The version of Sqlservr.exe is greater than or equal to 2005.90.5200.0
  • AND The version of Sqlservr.exe is less than 2005.90.5292.0
  • OR Microsoft SQL Server 2005 SP4 Analysis Services
  • Microsoft SQL Server 2005 Analysis Services is installed
  • AND GDR or QFE
  • The version of Msmdsrv.exe is less than 9.0.5057.0
  • OR Microsoft SQL Server 2005 SP4 Notification Services
  • Microsoft SQL Server 2005 Notification Services is installed
  • AND GDR or QFE
  • The version of Nsservice.exe is less than 9.0.5057.0
  • OR Microsoft SQL Server 2005 SP4 Reporting Services
  • Microsoft SQL Server 2005 Reporting Services is installed
  • AND GDR or QFE
  • The version of Reportingservicesservice.exe is less than 9.0.5057.0
  • OR Microsoft SQL Server 2005 SP4 Integration Services
  • Microsoft SQL Server 2005 Integration Services is installed
  • AND GDR or QFE
  • The version of Msdtssrvr.exe is less than 9.0.5057.0
  • OR Microsoft SQL Server 2005 SP4 Tools
  • Microsoft SQL Server 2005 Tools is installed
  • AND GDR or QFE
  • The version of Sqlwb.exe is less than 2005.90.5057.0
  • OR SQL Server 2008 Service Pack 1
  • SQL 2008
  • SQL 2008
  • Microsoft SQL Server 2008 is installed
  • AND HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\100\DTS\Setup\\SP equals 1
  • OR Microsoft SQL Server 2008 SP1 is installed
  • AND SQL 2008 DSCI
  • Microsoft SQL Server 2008 Database Services Core Instance
  • The version of Sqlservr.exe is less than 2007.100.2573.0
  • OR QFE
  • The version of Sqlservr.exe is greater than or equal to 2007.100.2800.0
  • AND The version of Sqlservr.exe is less than 2007.100.2841.0
  • OR Management Studio
  • The version of Sql_ssms_keyfile is less than 2007.100.2573.0
  • OR QFE
  • The version of sql_ssms_keyfile.dll is greater than or equal to 2007.100.2800.0
  • AND The version of sql_ssms_keyfile.dll is less than 2007.100.2841.0
  • OR SQL Server 2008 Service Pack 2
  • SQL 2008 SP2
  • SQL 2008 SP2
  • Microsoft SQL Server 2008 is installed
  • AND HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\100\DTS\Setup\\SP equals 2
  • OR Microsoft SQL Server 2008 SP2 is installed
  • AND SQL 2008 DSCI
  • Microsoft SQL Server 2008 Database Services Core Instance
  • The version of Sqlservr.exe is less than 2007.100.4064.0
  • OR QFE
  • The version of Sqlservr.exe is greater than or equal to 2007.100.4300.0
  • AND The version of Sqlservr.exe is less than 2007.100.4311.0
  • OR Management Studio
  • The version of Sql_ssms_keyfile is less than 2007.100.4064.0
  • OR QFE
  • The version of sql_ssms_keyfile.dll is greater than or equal to 2007.100.4300.0
  • AND The version of sql_ssms_keyfile.dll is less than 2007.100.4311.0
  • OR SQL Server 2008 R2
  • Microsoft SQL Server 2008 R2 is installed
  • AND Check if HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\.*\Setup!SQLPath exists
  • AND Microsoft SQL Server 2008 R2 Database Services Core Instance
  • The version of Sqlservr.exe is less than 2009.100.1617.0
  • OR The version of Sqlservr.exe is greater than or equal to 2009.100.1700.0 and less than 2009.100.1790.0
  • OR Microsoft Visual Studio 2005
  • Microsoft Visual Studio 2005 is installed.
  • AND The version of Microsoft.XmlEditor.dll is less than 2.0.50727.5065
  • OR Microsoft Visual Studio 2008
  • Microsoft Visual Studio 2008 is installed
  • AND The version of Microsoft.XmlEditor.dll is less than 3.5.30729.5665
  • OR Microsoft Visual Studio 2010
  • Microsoft Visual Studio 2010 is installed
  • AND Check if HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Visual Studio 2010.*!InstallLocation exists
  • AND The version of Microsoft.XmlEditor.dll is less than 10.0.30319.462
    • BACK