Microsoft Security Bulletin: August 2007 Security Bulletin

August 14, 2007 - Qualys^® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard^® to protect organizations against the 9 new vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.

Microsoft has released 9 security patches to fix 14 newly discovered flaws in Microsoft Windows.

Qualys has released the following checks for these new vulnerabilities:

Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution
SEVERITY: Urgent  5
QUALYS ID: 90405
VENDOR REFERENCE: MS07-042, 936227
CVE REFERENCE: CVE-2007-1749
CVSS SCORES: Base 5.7 / Temporal 4.2
THREAT: This Microsoft update resolves a vulnerability in Microsoft XML Core Services.
IMPACT: This vulnerability could allow remote code execution if a user viewed a specially crafted Web page using Internet Explorer. The vulnerability could be exploited through attacks on Microsoft XML Core Services.
SOLUTION: Refer to Microsoft Security Bulletin MS07-042 for further information and patch instructions. Microsoft has rated this issue as Critical.

Vulnerability in OLE Automation could allow remote code execution
SEVERITY: Critical  4
QUALYS ID: 90404
VENDOR REFERENCE: MS07-043, 921503
CVE REFERENCE: CVE-2007-2224
CVSS SCORES: Base 7/ Temporal 5.5
THREAT: A remote code execution vulnerability exists when a user accesses a specially crafted web page.
IMPACT: This vulnerability could be exploited through attacks on Object Linking and Embedding (OLE). Administrative users are affected more as compared to users having lesser rights. This vulnerability exists in all supported editions of Windows 2000, Windows XP, Office 2004 for Mac, and Visual Basic 6.
SOLUTION: Refer to Microsoft Security Bulletin MS07-043 for further details on this vulnerability and patch instructions. Microsoft has rated this issue as Critical.

Microsoft Excel Could Allow Remote Code Execution
SEVERITY: Urgent  5
QUALYS ID: 110063
VENDOR REFERENCE: MS07-044, 940965
CVE REFERENCE: CVE-2007- 3890
CVSS SCORES: Base 10/ Temporal 7.4
THREAT: Microsoft Excel is prone to a remote code execution issue due to insufficient handling of malformed Excel files. Specifically Excel does not perform sufficient validation when denoting the index value for a Workspace.
IMPACT: An attacker who successfully exploits this vulnerability could run arbitrary code on the affected system as the logged on user.
SOLUTION: Refer to Microsoft Security Bulletin MS07-044 for further details on this vulnerability and patch instructions. Microsoft has rated this issue as Critical.

Cumulative Security Update for Internet Explorer
SEVERITY: Critical  4
QUALYS ID: 100050
VENDOR REFERENCE: MS07-045, 937143
CVE REFERENCE: CVE-2007-0943, CVE-2007-2216, CVE-2007-3041
CVSS SCORES: Base 4.2 / Temporal 3.3
THREAT: A remote code execution vulnerability exists in Internet Explorer 5.01, 6 and 7.
IMPACT: A specially crafted web page using Internet Explorer may allow Remote Code Execution. Administrative users are impacted more than the users having lesser rights. Two of the vulnerabilities are addressed by setting the kill bit for ActiveX controls. The third vulnerability is addressed by modifying the way that Internet Explorer handles CSS files containing particular strings.
SOLUTION: Refer to Microsoft Security Bulletin MS07-045 for further details on this vulnerability and patch instructions. Microsoft has rated this issue as Critical.

Vulnerability in GDI Could Allow Remote Code Execution
SEVERITY: Critical  4
QUALYS ID: 90407
VENDOR REFERENCE: MS07-046, 938829
CVE REFERENCE: CVE-2007-3034
CVSS SCORES: Base 4.8/ Temporal 3.5
THREAT: A remote code execution vulnerability exists in the Graphics Rendering Engine because of the way that it handles specially crafted images. An attacker could exploit the vulnerability by constructing a specially crafted image that could potentially allow remote code execution if a user opened a specially crafted attachment in e-mail.
IMPACT: An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
SOLUTION: Refer to Microsoft Security Bulletin MS07-046 for further details on this vulnerability and patch instructions. Microsoft has rated the most severe of these issues as Critical.

Vulnerabilities in Windows Media Player Could Allow Remote Code Execution
SEVERITY: Critical  4
QUALYS ID: 90406
VENDOR REFERENCE: MS07-047, 936782
CVE REFERENCE: CVE-2007-3037, CVE-2007-3035
CVSS SCORES: Base 8/ Temporal 5.9
THREAT: A remote code execution vulnerability exists in Windows Media Player.
IMPACT: An attacker who successfully exploited this vulnerability could take complete control of an affected system.
SOLUTION: Refer to Microsoft Security Bulletin MS07-047 for further details on this vulnerability and patch instructions. Microsoft has rated the most severe of these issues as Important.

Windows Gadgets Could Allow Remote Code Execution
SEVERITY: Serious  3
QUALYS ID: 115613
VENDOR REFERENCE: MS07-048, 938123
CVE REFERENCE: CVE-2007-3032, CVE-2007-3033, CVE-2007-3891
CVSS SCORES: Base 2.9/ Temporal 2.3
THREAT: Windows Gadgets are mini applications. They can connect to web services to deliver business data, weather information, news updates, traffic maps, Internet radio streams, and even integrate with other programs to provide streamlined interaction. Microsoft Security Bulletin MS07-048 addresses remote code execution issues with the following gadgets. Windows Vista Feed Headlines Gadget Windows Vista Contacts Gadget Windows Vista Weather Gadget
IMPACT: An attacker could run code with the privileges of the logged on user.
SOLUTION: Refer to Microsoft Security Bulletin MS07-048 for further details on this vulnerability and patch instructions. Microsoft has rated this issue as Important.

Virtual PC and Virtual Server Could Allow Elevation of Privilege
SEVERITY: Serious  3
QUALYS ID: 115612
VENDOR REFERENCE: MS07-049, 937986
CVE REFERENCE: CVE-2007-0948
CVSS SCORES: Base 7 / Temporal 5.2
THREAT: An elevation of privilege vulnerability exists in Microsoft Virtual PC and Microsoft Virtual Server due to inaccurate initialization of components that communicate with the host operating system.
IMPACT: An attacker could take complete control of an affected system. The attacker could then gain access to host or other guest operating systems.
SOLUTION: Refer to Microsoft Security Bulletin MS07-049 for further details on this vulnerability and patch instructions. Microsoft has rated this issue as Important.

Vulnerability in Vector Markup Language Could Allow Remote Code Execution
SEVERITY: Urgent  5
QUALYS ID: 100051
VENDOR REFERENCE: MS07-050, 938127
CVE REFERENCE: CVE-2007-1749
CVSS SCORES: Base 4.8/ Temporal 3.5
THREAT: This Microsoft update resolves a vulnerability in the Vector Markup Language (VML) implementation in Windows
IMPACT: The vulnerability could allow remote code execution if a user viewed a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
SOLUTION: Refer to Microsoft Security Bulletin MS07-050 for further information and patch instructions. Microsoft has rated this issue as Critical.

This new vulnerability check is included in Qualys vulnerability signatures v1.18.24-5. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

1. Ensure access to TCP ports 135 and 139 are available.
2. Enable Windows Authentication (specify Authentication Records).
3. Enable the following Qualys IDs:
   • 90405
   • 90404
   • 110063
   • 100050
   • 90407
   • 90406
   • 115613
   • 115612
   • 100051
4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.

For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102

QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/solutions/free/trials