Microsoft Investigates SharePoint 2007 Zero Day
Microsoft is scrambling to fix a bug in its SharePoint 2007 groupware after a Swiss firm abruptly released code that could be used in an attack. The proof-of-concept code was released Wednesday, just over two weeks after security consultancy High-Tech Bridge says it disclosed the issue to Microsoft on April 12.
Although Microsoft hasn't said much about the seriousness of the bug, security experts worry that hackers could exploit the flaw in order to steal sensitive corporate information used by SharePoint customers, who use the software for building Web portals and collaborating on internal projects.
High-Tech Bridge discovered what is known as a cross-site scripting flaw in SharePoint. If the attacker can get a SharePoint user to click on a link, the bug lets the attacker essentially take control of the user's account.
