Signature Detail

HTTP: Microsoft MSXML XSLT Remote Code Execution

This signature detects attempts to exploit a known vulnerability against Microsoft XML Core Services. A successful attack can lead to arbitrary code execution.

Extended Description

Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."

Affected Products

• Microsoft expression_web *
• Microsoft expression_web 2
• Microsoft groove_server 2007
• Microsoft office 2003
• Microsoft office 2007
• Microsoft office_compatibility_pack *
• Microsoft sharepoint_server 2007
• Microsoft windows_7 -
• Microsoft windows_8 -
• Microsoft windows_rt -
• Microsoft windows_server_2003 *
• Microsoft windows_server_2008 -
• Microsoft windows_server_2008 *
• Microsoft windows_server_2008 r2
• Microsoft windows_server_2012 -
• Microsoft windows_vista *
• Microsoft windows_xp -
• Microsoft windows_xp *
• Microsoft word_viewer *
• Microsoft xml_core_services 3.0
• Microsoft xml_core_services 4.0
• Microsoft xml_core_services 5.0
• Microsoft xml_core_services 6.0

References

• CVE: CVE-2013-0007