Microsoft Security Bulletin MS12-040 - Important

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• In a web-based attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website and then convince them to click a specially crafted URL that is used to exploit the vulnerability.
• Internet Explorer 8 and Internet Explorer 9 users browsing to a Microsoft Dynamics AX 2012 Enterprise Portal site in the Internet Zone are at a reduced risk. By default, the XSS Filter in Internet Explorer 8 and Internet Explorer 9 prevents this attack in the Internet Zone. The XSS Filter in Internet Explorer 8 and Internet Explorer 9, however, is not enabled by default in the Intranet Zone.
• The vulnerability cannot be exploited automatically through email. For an attack to be successful, a user must click a specially crafted URL that is sent in an email message.

Workaround refers to a setting or configuration change that does not correct the underlying vulnerability but would help block known attack vectors before you apply the update. Microsoft has tested the following workarounds and states in the discussion whether a workaround reduces functionality:

• Enable Internet Explorer 8 and Internet Explorer 9 XSS filter in the Local intranet security zone

  You can help protect against exploitation of this vulnerability by changing your settings to enable the XSS filter in the Local intranet security zone. (XSS filter is enabled by default in the Internet security zone.) To do this, perform the following steps:

  1. In Internet Explorer 8 or Internet Explorer 9, click Internet Options on the Tools menu.
  2. Click the Security tab.
  3. Click Local intranet, and then click Custom Level.
  4. Under Settings, in the Scripting section, under Enable XSS filter, click Enable, and then click OK.
  5. Click OK two times to return to Internet Explorer.

  Impact of workaround. Internal sites not previously flagged as being XSS risks could be flagged.

  How to undo the workaround. 

  To undo this workaround, perform the following steps:

  1. In Internet Explorer 8 or Internet Explorer 9, click Internet Options on the Tools menu.
  2. Click the Security tab.
  3. Click Local intranet, and then click Custom Level.
  4. Under Settings, in the Scripting section, under Enable XSS filter, click Disable, and then click OK.
  5. Click OK two times to return to Internet Explorer.

What is the scope of the vulnerability? 
This is a cross-site scripting vulnerability that could result in elevation of privilege or information disclosure.

What is the component affected by the vulnerability? 
The Enterprise Portal component of Microsoft Dynamics AX 2012 is affected.

What causes the vulnerability? 
The vulnerability is caused when Microsoft Dynamics AX Enterprise Portal does not properly handle malicious JavaScript elements contained within a specially crafted URL, allowing the script to be displayed back to the user's browser.

What is cross-site scripting? 
Cross-site scripting (XSS) is a class of security vulnerability that can enable an attacker to inject script code into a user's session with a website. The vulnerability can affect web servers that dynamically generate HTML pages. If these servers embed browser input in the dynamic pages that they send back to the browser, these servers can be manipulated to include maliciously supplied content in the dynamic pages. This can allow malicious script to be executed. Web browsers may perpetuate this problem through their assumptions of trusted sites and their use of cookies to maintain persistent state with the websites that they frequent. An XSS attack does not modify website content. Instead, it inserts new, malicious script that can execute at the browser in the context that is associated with a trusted server.

What might an attacker use the vulnerability to do? 
An attacker who successfully exploited this vulnerability could read content that the attacker is not authorized to read, use the victim's identity to take actions on the Microsoft Dynamics AX Enterprise Portal site on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim.

How could an attacker exploit the vulnerability? 
For this vulnerability to be exploited, a user must click a specially crafted URL that takes the user to a targeted Microsoft Dynamics AX Enterprise Portal site that then displays the script back to the user's browser.

In an email attack scenario, an attacker could exploit the vulnerability by sending an email message that contains the specially crafted URL to the user of the targeted Microsoft Dynamics AX Enterprise Portal site and by convincing the user to click the specially crafted URL.

In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted URL to the targeted Microsoft Dynamics AX Enterprise Portal site that is used to attempt to exploit this vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted website. Instead, an attacker would have to convince them to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes them to the attacker's website, and then convince them to click the specially crafted URL.

What systems are primarily at risk from the vulnerability? 
Systems where users connect to a Microsoft Dynamics AX 2012 Enterprise Portal server, such as workstations or terminal servers, are primarily at risk.

What is the Internet Explorer 8 and Internet Explorer 9 Cross-site Scripting (XSS) Filter? 
Cross-site scripting attacks try to exploit vulnerabilities in the websites you use. Cross-site scripting attacks have emerged as a leading online threat, so Internet Explorer 8 and Internet Explorer 9 include a cross-site scripting filter that can detect these types of attacks and disable the harmful scripts. By default, the cross-site scripting filter is turned on in Internet Explorer 8 and Internet Explorer 9 for the Internet Zone.

What does the update do? 
The update addresses the vulnerability by correcting the way that Microsoft Dynamics AX 2012 Enterprise Portal validates and sanitizes user input.

When this security bulletin was issued, had this vulnerability been publicly disclosed? 
No. Microsoft received information about this vulnerability through coordinated vulnerability disclosure.

When this security bulletin was issued, had Microsoft received any reports that this vulnerability was being exploited? 
No. Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers when this security bulletin was originally issued.

Reference Table

The following table contains the security update information for this software. You can find additional information in the subsection, Deployment Information, in this section.