Microsoft Security Bulletin MS13-100 - Important

Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2904244)

Published: Tuesday, December 10, 2013

Version: 1.0

General Information

Executive Summary

This security update resolves multiple privately reported vulnerabilities in Microsoft Office server software. These vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a SharePoint server. An attacker who successfully exploited these vulnerabilities could run arbitrary code in the security context of the W3WP service account on the target SharePoint site.
This security update is rated Important for supported editions of Microsoft SharePoint Server 2013 and for affected Microsoft Office Services and Web Apps on supported editions of Microsoft SharePoint Server 2010 and Microsoft SharePoint Server 2013. For more information, see the subsection, Affected and Non-Affected Software, in this section.
The security update addresses the vulnerabilities by correcting how SharePoint server sanitizes specially crafted page content. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.
Recommendation. Customers can configure automatic updating to check online for updates from Microsoft Update by using the Microsoft Update service. Customers who have automatic updating enabled and configured to check online for updates from Microsoft Update typically will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates from Microsoft Update and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.
For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update at the earliest opportunity using update management software, or by checking for updates using the Microsoft Update service.

The SharePoint experience

Feeling the holiday lull? Don't really want to work? Plan now so you can play later. Register today to jump start 2014 with SharePoint online training for 2010 & 2013.

the sharepoint experience It's not just a course, it is an experience.

SharePoint Web Developer Experience January 7-10th, $1295/person Craft code for all SharePoint versions. Data manipulation and display with zero Visual Studio. Learn More & Register   SharePoint CSS Experience January 14-15th, $695/person Use only CSS to completely alter SharePoint site design. CSS basics plus advanced techniques. Learn More & Register SharePoint 2013 Master Pages Experience January 16-17th, $695/person Learn SharePoint 2013 Design Manager and how to create master page files from scratch. Learn More & Register   SharePoint 2010 Branding Experience February 4-6th, $995/person Branding start to finish with special focus on master pages, CSS and page layouts. Learn More & Register

 

Enter your credentials to connect to the following web service: InfoPath 2007

Issue: User get the authentication prompt when trying to open the InfoPath form from a SharePoint form library.

Background:

While submitting the credentials user can open the form, however, when he try to pull some of the information from the drop down menu which is custom felid, he can’t see the information in the field.

 

Basic checks:

1. Initially I though it is a problem of the IE version, So we did some basic level of troubleshooting such as
2. Clearing the IE history,
3. Resetting the IE to factory settings.
4. Repairing the Office using MS office diagnostic tool.
5. Clearing the InfoPath cache from Start -> Select Run- > Enter ‘InfoPath /cache clearall’.
6. Deleted all files and folders within any other folders starting with FormCache: C:\Documents and Settings\[User]\Local Settings\Application Data\Microsoft\InfoPath
   **Note: [User] is your logon ID
7. Asked user to login to any other machine, there we saw the same behaviour.

So this is something not a machine specific issue and not that easy as I was thinking.

 

Troubleshooting:

 

I tried to reproduce the problem with my normal user account.

 

Note: As a SharePoint admin we have two accounts to work with a normal user account and the Account with the farm level admin rights.

 

When accessing the form with the high privileged account I was able to populate the values in the custom field in the InfoPath Form, however, with my normal user account I was also facing the same problem. BOOM…

 

It’s was not something very easy now.

 

I tried to isolate the problem by adding my account at different level of permissions (Read/Contribute/Full Control) at Top level site/sub-site and the doc library level.

 

Nothing worked for me.

 

Now it was something to deal at the form level. I need to dig in the form structure to check where the problem was lying.

 

One was sure that while opening the Form it was talking to the list in the background via a web service (_vti_bin_lists.asmx) as you may have noticed from the authentication box.

1. Edited the form in the design mode.
2. Checked the properties of the drop-down box.

    3. As you can see from the properties the ‘List box entries’ was using the values form external data source. (Note: External data source can be anything like a XML Document, a Database, a Web service and SharePoint Library or list.



   4.This information, you can look at the by adding the data sources to the drop down box.

   5. By modifying we get to know from which list the field was populating the values.
 
   6. Accessed that list from SharePoint site and checked that the list was not inheriting permissions from its Parent site.

   7. Added my normal account and user account with the contribute permissions to the list and tried to access the form again and this time it didn’t asked for any authentication and values were also populating the drop-down of the InfoPath form.

To conclude it was a permissions issue not on the form library though was a permission issue on the list from where Values were populating in the form.

 

If you face any issue or have any concerns, do let me know, it would be happy to help you with.

TechNet Wiki Link:

 

Product Applies to: SharePoint 2007, InfoPath 2007, SharePoint Server 2010 and InfoPath 2010.

Change site logo in SharePoint 2013

Today i would like to share a simple and easy topic as it’s a good idea to choose a title that describes your team or project.

1.   Open your SharePoint site

2.   Settings

3.   Site settings

4.   Under the look and feel

5.   Click title, description and logo

6.   To upload your logo from your computer

7.   Click From Computer

8.   Click Browse

9.   Locate the image and click Open

Additional option- You can also upload the image in your SharePoint document library and select it from there as- browse to the library where the image is stored, select the image and click Insert.

Click OK and that’s it.

Image will be successfully uploaded and site logo can be change without any problems.

Note: If you don’t see Title, description, and logo, you probably don’t have permission to manage that option. You need to have at least permissions equivalent to being in the Owners group on your site.

Incoming email settings SharePoint not working: SharePoint 2010

Recently I have started working in configuring SharePoint incoming email settings and completed the functionality on positive note :)

Why I am writing this article? – While working on this functionality I faced so many challenges and numerous error messages, & I would like to share those experiences and resolutions so that it would be useful for all the SharePoint communities.

I worked on two different environments and every environment has different challenges:

§  DEV environment

§  UAT environment

Development environment-

This is standalone environment i.e. configured as App plus WFE. It’s very easy to configure incoming email settings on standalone machine.

What are the pre-requisites required for incoming email settings?

1.   SMTP configuration

2.   Starting of SMTP service

3.   Setup send connector from exchange side

4.   Configure incoming email settings in SharePoint central administration ->system settings->Incoming email settings

5.   Configure incoming settings at the document library level.

Reference: http://technet.microsoft.com/en-us/library/cc287879%28v=office.14%29.aspx

Please use the above article for the detail information as it’s quite amazing.

I will not discuss here how to setup the incoming email as the above article will help you to get that information but in case of any queries/questions then please feel free to get back to me.

Notes-

1.   By means of send connector, you can set the routing for your server FQDN or hostname as per your requirements.

2.   Whatever the hostname you will set, you need to make that entry in SMTP also

3.   Last but important point, mail host – this will hold the mail address of your exchange server.

UAT environment- This environment hold one application server and one web front end. Tricky one! It’s always a challenge to configure the incoming email settings in multiple server environments.

Guidelines-

1.   Make sure you configure the SMTP on the front end servers

2.   Ensure you setup the proper path of drop folder across all front ends.

3.   It’s not recommended but sharing my experience as while configuring the SMTP, makes sure you use IP address in relay and connections tab.

4.   If you are using a hostname then ensure that you do make the entry of the same in SMTP under “outgoing email” tab.

5.   Do make the same hostname entry at the document library level.

If you have any queries/questions regarding the above mentioned information then please let me know. I would be more than happy to help you as well as resolves your issues, Thank you.

Product applies to-

1.   SharePoint server 2010

2.   SharePoint Foundation 2010

3.   SharePoint server 2013

4.   SharePoint Foundation 2013

5.   Microsoft Office SharePoint Server 2007

References:-

Configure incoming email for a SharePoint 2013 farm

http://technet.microsoft.com/en-us/library/cc262947.aspx

Configure incoming e-mail (SharePoint Foundation 2010)

http://technet.microsoft.com/en-us/library/cc287879%28v=office.14%29.aspx

How to configure Incoming and Outgoing emails in SharePoint Server 2010

http://blogs.msdn.com/b/pareshg/archive/2010/04/23/how-to-configure-incoming-and-outgoing-emails-in-sharepoint-server-2010.aspx

Configure incoming e-mail (Office SharePoint Server Central Administration Help)

http://technet.microsoft.com/en-us/library/cc262775%28v=office.12%29.aspx

401 UNAUTHORIZED with anonymous access: SharePoint 2010

One more new query from end user so here it comes my new article! Not query but actually an issue which requires some troubleshooting and correct guidelines to proceed for the resolution. One thing we need to understand that every issue requires thorough analysis and based on those analysis points, we can resolve the issue. By means of writing such articles, I would like to guide my SP-communities, SP audiences, my SP-friends / my colleagues, SharePoint Administrators- a proper set of guidelines so that they can resolve the issue and in case of any problems then please reach out to me so that we can discuss on the same and proceed further!

Farm attributes:-

-2WFE’s, 1 APP, 2 SQL instances in clustering mode

-SharePoint 2013

-Windows Server 2008 R2

-IE10

Problem description:-

I have created an anonymous site in SharePoint 2010 foundation and when i click on sign in, it shows me "401 UNAUTHORIZED". The machine is on a hosted environment and I am accessing it through a host header in extranet zone of alternate access mapping path.

Error message:-

401 UNAUTHORIZED

Troubleshooting steps:-

1)   As the site is anonymous then it does not have to ask for credentials. Make sure that's not the case.

2)   Make sure that you have already followed all the guidelines as how to setup the anonymous site across the complete site collection plus list and libraries.

3)   It might be browser specific so make sure that you test this scenario across multiple browsers

4)   As this is an extranet site, so obviously customizations are there on the home page as well. If that is the case then make sure the page is not check out. If yes then please approve it and check the results

5)   In most of the anonymous cases, one most common issue happens i.e. If the web part present on the home page need to query data from other list while anonymous user has no permission to access those lists, then maybe you would get the problem.

In my case, this is the resolution:-

1)   It was a webpart causing the problem.

2)   Present on the home page which requires permissions to access that specific list as it is fetching data from the external list.

3)   Removed the webpart

4)   Checked the results and works like a charm!

Product applies to:-

1.   SharePoint Server 2013

2.   SharePoint foundation 2013

3.   SharePoint server 2010

4.   SharePoint foundation 2010