September 8, 2009 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 5 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.
Microsoft has released 5 security patches to fix newly discovered flaws in Microsoft Windows.
Qualys has released the following checks for these new vulnerabilities:
| Microsoft JScript Scripting Engine Remote Code Execution Vulnerability |
|---|
SEVERITY: Serious  3 |
| QUALYS ID: 90522 |
| VENDOR REFERENCE: MS09-045 |
| CVE REFERENCE: CVE-2009-1920 |
| CVSS SCORES: Base 6.8/ Temporal 5.3 |
| THREAT: JScript is an interpreted, object-based scripting language that is often used to make Web sites more flexible or interactive.
A remote code execution vulnerability is caused by the way that the JScript scripting engine processes scripts in Web pages. When the JScript scripting engine attempts to load the decoded script into memory in order to run it, a memory corruption can occur that may either cause Internet Explorer to stop responding, or lead to code execution. (CVE-2009-1920) Microsoft has released a security update addresses the vulnerability by modifying the way that the JScript engine processes scripts in Web pages. This security update is rated Critical for JScript 5.1 on Microsoft Windows 2000 Service Pack 4 and Critical for JScript 5.6, JScript 5.7 and JScript 5.8 on all supported releases of the Windows operating system except Windows 7 and Windows Server 2008 R2. |
| IMPACT: Successful exploitation of these vulnerabilities could allow remote code execution if a user opened a specially crafted file or visited a specially crafted Web site and invoked a malformed script. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Windows 2000 Service Pack 4 (JScript 5.1 and JScript 5.6) Windows XP Service Pack 2 (JScript 5.6) Windows XP Service Pack 2 (JScript 5.7) Windows XP Service Pack 3 (JScript 5.7) Windows XP Service Pack 2 and Windows XP Service Pack 3 (JScript 5.8) Windows XP Professional x64 Edition Service Pack 2 (JScript 5.6) Windows XP Professional x64 Edition Service Pack 2 (JScript 5.7) Windows XP Professional x64 Edition Service Pack 2 (JScript 5.8) Windows Server 2003 Service Pack 2 (JScript 5.6) Windows Server 2003 Service Pack 2 (JScript 5.7) Windows Server 2003 Service Pack 2 (JScript 5.8) Windows Server 2003 x64 Edition Service Pack 2 (JScript 5.6) Windows Server 2003 x64 Edition Service Pack 2 (JScript 5.7) Windows Server 2003 x64 Edition Service Pack 2 (JScript 5.8) Windows Server 2003 with SP2 for Itanium-based Systems (JScript 5.6) Windows Server 2003 with SP2 for Itanium-based Systems (JScript 5.7) For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-045.
Workaround: Detailed steps on applying the workarounds can be found at Microsoft Security Bulletin MS09-045.
Impact of the Workaround: |
| Microsoft DHTML Editing Component ActiveX Control Remote Code Execution Vulnerability |
|---|
SEVERITY: Critical  4 |
| QUALYS ID: 90523 |
| VENDOR REFERENCE: MS09-046 |
| CVE REFERENCE: CVE-2009-2519 |
| CVSS SCORES: Base 7.5/ Temporal 5.5 |
| THREAT: The DHTML Editing Component ActiveX control supports dynamic Web site HTML editing.
It is vulnerable to a remote code execution issue when the Microsoft DHTML Editing Component ActiveX Control is instantiated in Internet Explorer. An attacker could exploit the vulnerability by constructing a malicious Web page that allows remote code execution if an unsuspecting user visits that page. (CVE-2009-2519) Microsoft has released a security update that addresses the vulnerability by revising the way that the ActiveX control formats HTML markup. |
| IMPACT: Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code with the privileges of the user who is logged-on. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Windows 2000 Service Pack 4 Windows XP Service Pack 2 and Windows XP Service Pack 3 Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Refer to Microsoft Security Bulletin MS09-046 for further details.
Workarounds: Impact of workaround #1: There is no impact because the DHTML ActiveX control COM object is not intended to be used in Internet Explorer. 2) Set Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting. 3) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local Intranet security zones.
Impact of workarounds #2 and #3: Detailed instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-046. |
| Microsoft Windows Media Format Remote Code Execution Vulnerability |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90524 |
| VENDOR REFERENCE: MS09-047 |
| CVE REFERENCE: CVE-2009-2498, CVE-2009-2499 |
| CVSS SCORES: Base 9.3/ Temporal 7.7 |
| THREAT: Microsoft Windows Media Format Runtime provides information and tools for applications that use Windows Media content. The following vulnerabilities exists in the way Microsoft Windows processes media files.
- The Windows component responsible for processing Advanced Systems Format (ASF) files does not properly handle specially crafted ASF files with malformed headers. An attacker can exploit this issue by enticing an unsuspecting user into opening a specially crafted ASF file or by sending specially crafted streaming content from a Web site or any application that delivers Web content. (CVE-2009-2498) - A remote code execution vulnerability exists because the Windows component responsible for processing MPEG-1 Audio Layer 3 (MP3) files does not properly handle specially crafted metadata. Exploitation of this vulnerability requires that a user opens a specially crafted MP3 file or receives specially crafted streaming content from a Web site or any application that delivers Web content. (CVE-2009-2499) Microsoft has released a security update that addresses these vulnerabilities by modifying the way that Windows Media Format Runtime parses Advanced Systems Format (ASF) files and MPEG-1 Audio Layer 3 (MP3) files. |
| IMPACT: Successful exploitation of either vulnerability could allow remote code execution if a user opened a specially crafted media file. If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Windows 2000 Service Pack 4 (Windows Media Format Runtime 9.0) Windows XP Professional x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5) Windows XP Professional x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5 x64 Edition) Windows XP Professional x64 Edition Service Pack 2 (Windows Media Format Runtime 11) Windows Server 2003 Service Pack 2 (Windows Media Format Runtime 9.5) Windows Server 2003 x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5) Windows Server 2003 x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5 x64 Edition) For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-047.
Workaround: Impact of workaround: Media files cannot be played in Windows Explorer or in Windows Media Player. Windows Media Player may exit with an error. Detailed information on enabling and disabling the workarounds can be found at Microsoft Security Bulletin MS09-047. |
| Microsoft Windows TCP/IP Remote Code Execution Vulnerabilities |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90525 |
| VENDOR REFERENCE: MS09-048 |
| CVE REFERENCE: CVE-2008-4609, CVE-2009-1925, CVE-2009-1926 |
| CVSS SCORES: Base 8.5/ Temporal 6.3 |
| THREAT: TCP/IP is a set of networking protocols that are widely used on the Internet. The following vulnerabilities exist in the Windows TCP/IP stack.
- A denial of service vulnerability exists because the Windows TCP/IP stack does not properly handle large numbers of established TCP connections. If these established connections are abused by a remote system requesting data and setting the TCP receive window size to a small or a zero value, the denial of service condition can be amplified. (CVE-2008-4609) - A remote code execution vulnerability is caused by the Windows TCP/IP stack not cleaning up state information correctly. This causes the TCP/IP stack to reference a field as a function pointer when it actually contains other information. (CVE-2009-1925) - A denial of service vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of specially crafted packets with a small or zero TCP receive window size. An attacker could exploit the vulnerability by flooding a system with specially crafted packets causing the affected system to stop responding to new requests. (CVE-2009-1926) Microsoft has released a security update that addresses these vulnerabilities by dropping existing TCP connections adaptively and limiting the number of new TCP connections until system resources are restored, and changing the manner in which TCP/IP packets are processed. |
| IMPACT: Successful exploitation of these vulnerabilities can be exploited to cause denial of service conditions or execute arbitrary code on the system. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 Refer to Microsoft Security Bulletin MS09-048 for further details. NOTE: Microsoft has not issued an update for Microsoft Windows 2000 Service Pack 4.
Workarounds: 1) Enable advanced TCP/IP filtering on systems that support this feature to block all unsolicited inbound traffic. Additional information on configuring TCP/IP filtering can be found in the Microsoft Knowledge Base Article 309798. 2) Use a personal firewall, such as the Internet Connection Firewall. To obtain additional details on applying the workarounds, please refer to Microsoft Security Bulletin MS09-048. |
| Microsoft Windows Wireless LAN AutoConfig Service Remote Code Execution Vulnerability |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90526 |
| VENDOR REFERENCE: MS09-049 |
| CVE REFERENCE: CVE-2009-1132 |
| CVSS SCORES: Base 9.3/ Temporal 7.7 |
| THREAT: WLAN AutoConfig is a service that configures wireless security and connectivity settings.
The Windows Wireless LAN AutoConfig Service (Wlansvc) fails to validate hidden SSID information elements in access point beacons. A malicious access point (or host functioning as an access point) could use this to cause arbitrary code to be executed with the privileges of the user running the WLANSVC. (CVE-2009-1132) Microsoft has released a security update that addresses the vulnerability by extending the Wireless LAN AutoConfig service to properly validate wireless frames prior to processing them. |
| IMPACT: Successful exploitation of this vulnerability results in complete remote system compromise if the user is running with administrator permissions, or account compromise if the user is running with reduced privileges. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 Refer to Microsoft Security Bulletin MS09-049 for further details.
Workaround:
Using the Interactive Method
Using a Managed Deployment Script Impact of workaround: Wireless networking will not be available. |
This new vulnerability check is included in Qualys vulnerability signatures v1.23.74-4. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.
SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
- Enable the following Qualys IDs:
- 90522
- 90523
- 90524
- 90525
- 90526
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
Access for QualysGuard customers: https://qualysguard.qualys.com
Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/
