A remote code execution vulnerability exists in the Web Services on Devices API (WSDAPI) on Windows systems. The vulnerability is caused by the WSDAPI, on both clients and servers, because it does not correctly validate specific headers of a received WSD message. (CVE-2009-2512)

Microsoft has released a security update to addresses this vulnerability by correcting the processing of headers in WSD messages. This security update is rated Critical for all supported editions of Windows Vista and Windows Server 2008.

Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS09-063 for further details.

Workaround:
Configure the Windows Firewall to block inbound TCP ports 5357 and 5358, and outbound UDP port 3702. Blocking the inbound ports prevents malicious remote hosts from sending specially crafted headers to the affected component.

Impact of the workaround:
Device discovery will not work while this workaround is enabled.

The service is vulnerable to remote code execution since it fails to validate the length of a string passed through an RPC call. (CVE-2009-2523)

Microsoft Windows 2000 is vulnerable.

Microsoft has released a security update that addresses the vulnerability by changing the way the License Logging service validates a specific field inside the RPC packet.

Microsoft Windows 2000 Server Service Pack 4

Refer to Microsoft Security Bulletin MS09-064 for further details.

Workarounds:

1) Disable the License Logging service. To do this, perform the following steps:
- Click Start, and then click Control Panel.
- Double-click Administrative Tools.
- Double-click Services.
- Double-click License Logging Service.
- In the Startup type list, click Disabled.
- Click Stop, and then click OK.

Impact of workaround #1:
If the License Logging service is disabled, any services that explicitly depend on the License Logging service may log an error message in the system event log.

2) TCP ports 139 and 445 should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability.

Impact of workaround #2:
Blocking the ports can cause several windows services or applications using those ports to stop functioning.

Windows kernel is prone to the following vulnerabilities:

- An elevation of privilege vulnerability exists in Windows kernel that is caused by the Windows kernel not properly validating an argument passed to a Windows kernel system call. (CVE-2009-1127)

- An elevation of privilege vulnerability exists in Windows kernel-mode drivers due to improper validation of input passed from user mode through the kernel component of GDI. (CVE-2009-2513)

- A remote code execution vulnerability exists in the Windows kernel-mode drivers due to the improper parsing of font code when building a table of directory entries. (CVE-2009-2514)

Microsoft has released a security update that addresses these vulnerabilities by correcting the method used for validating the argument passed to the system call, validating input passed from user mode through the kernel component of GDI, and correcting the manner in which Windows kernel-mode drivers parse font code.

Microsoft Windows 2000 Service Pack 4

Windows XP Service Pack 2 and Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS09-065 for further details.

Workarounds:

For CVE-2009-2514:
1) Disable support for parsing embedded fonts in Internet Explorer. Microsoft has provided an automated Microsoft Fix solution to enable or disable this workaround. Refer to KB969947 for the automated solution.

Impact of workaround #1:
Web sites making use of embedded font technology will fail to display properly.

2) Deny Access to T2EMBED.DLL

Impact of workaround #2:
Applications that rely on embedded font technology will fail to display properly.

To obtain additional details on enabling and disabling the workarounds, please refer to Microsoft Security Bulletin MS09-065.

- A denial of service vulnerability exists in implementations of Active Directory on Microsoft Windows 2000 Server, Windows Server 2003, and Windows Server 2008. The vulnerability also exists in implementations of ADAM when installed on Windows XP and Windows Server 2003, and AD LDS on Windows Server 2008. The vulnerability is due to stack space exhaustion during execution of certain types of LDAP or LDAPS requests. (CVE-2009-1928)

Microsoft has released a security update that addresses the vulnerability by changing the way Active Directory, ADAM, and AD LDS process malformed LDAP or LDAPS requests.

Microsoft Windows 2000 Server Service Pack 4 (Active Directory)

Windows XP Service Pack 2 and Windows XP Service Pack 3 (Active Directory Application Mode (ADAM))

Windows XP Professional x64 Edition Service Pack 2 (Active Directory Application Mode (ADAM))

Windows Server 2003 Service Pack 2 (Active Directory)

Windows Server 2003 Service Pack 2 (Active Directory Application Mode )

Windows Server 2003 x64 Edition Service Pack 2 (Active Directory)

Windows Server 2003 x64 Edition Service Pack 2 (Active Directory Application Mode )

Windows Server 2003 with SP2 for Itanium-based Systems (Active Directory)

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Active Directory and Active Directory Lightweight Directory Service (AD LDS))

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Active Directory and Active Directory Lightweight Directory Service (AD LDS))

Refer to Microsoft Security Bulletin MS09-066 for further details.

Workaround:
- Block TCP ports 389, 636, 3268 and 3269 at the firewall. These ports are used to initiate a connection with the affected component. Blocking them at the enterprise firewall, both inbound and outbound, will help prevent systems that are behind that firewall from attempts to exploit this vulnerability.

A remote code execution vulnerability exists in the way that Microsoft Office Excel handles specially crafted Excel files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3127).

A remote code execution vulnerability exists in the way Microsoft Office Excel handles specially crafted Excel files that include a malformed record object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3128)

A remote code execution vulnerability exists in the way that Microsoft Office Excel handles specially crafted Excel files that include a malformed record object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3129)

A remote code execution vulnerability exists in the way Microsoft Office Excel handles specially crafted Excel files with malformed BIFF records. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3130)

A remote code execution vulnerability exists in the way that Microsoft Office Excel parses documents containing a specially crafted formula embedded inside a cell. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3131)

A remote code execution vulnerability exists in Microsoft Office Excel as a result of pointer corruption when loading Excel formulas. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed formula. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3132)

A remote code execution vulnerability exists in Microsoft Office Excel as a result of memory corruption when loading Excel records. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed object. An attacker who successfully exploited this vulnerability could take complete control of an affected system.(CVE-2009-3133)

A remote code execution vulnerability exists in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed record object. An attacker who successfully exploited this vulnerability could take complete control of an affected system.(CVE-2009-3134)

Microsoft has released a security update that addresses these vulnerabilities by modifying the way that Excel opens and parses Excel files, and by modifying the way that Excel handles malformed records.

Microsoft Office XP Service Pack 3 (Microsoft Office Excel 2002 Service Pack 3)

Microsoft Office 2003 Service Pack 3 (Microsoft Office Excel 2003 Service Pack 3)

2007 Microsoft Office System Service Pack 1 and 2007 Microsoft Office System Service Pack 2 (Microsoft Office Excel 2007 Service Pack 1 and Microsoft Office Excel 2007 Service Pack 2)

Microsoft Office 2004 for Mac

Microsoft Office 2008 for Mac

Open XML File Format Converter for Mac

Microsoft Office Excel Viewer 2003 Service Pack 3

Microsoft Office Excel Viewer Service Pack 1 and Microsoft Office Excel Viewer Service Pack 2

Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1 and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2

Refer to Microsoft Security Bulletin MS09-067 for further details.

Workarounds:
1) Avoid opening Office files received from untrusted sources.

2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or untrusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

Impact of workaround #2:
Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

3) Microsoft Office File Block policy should be used to block the opening of Office 2003 and earlier documents from unknown or untrusted sources. The following registry scripts can be used to set the File Block policy.
Note: Modifying the Registry incorrectly can cause serious problems that may require re-installation of the operating system.

For Office 2003:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001

For 2007 Office system:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Office.0\Excel\Security\FileOpenBlock]
"BinaryFiles"=dword:00000001

Impact of workaround #3:
If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

A remote code execution vulnerability exists in the way that Microsoft Office Word handles a specially crafted Word file that includes a malformed record. An attacker can entice an unsuspecting user into opening a maliciously crafted Word file which may corrupt system memory in such a way that arbitrary code can be executed. (CVE-2009-3135)

Microsoft has released an update that addresses the vulnerabilities by modifying the way that Word opens files.

Microsoft Office XP Service Pack 3 (Microsoft Office Word 2002 Service Pack 3)

Microsoft Office 2003 Service Pack 3 (Microsoft Office Word 2003 Service Pack 3)

Microsoft Office 2004 for Mac

Microsoft Office 2008 for Mac

Open XML File Format Converter for Mac

Microsoft Office Word Viewer 2003 Service Pack 3

Microsoft Office Word Viewer

Refer to Microsoft Security Bulletin MS09-068 for further details.

Workarounds:
1) Avoid opening Office files received from untrusted sources.

2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or untrusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

Impact of workaround #2:
Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.