December 8, 2009 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 6 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.
Microsoft has released 6 security patches to fix newly discovered flaws in Microsoft Windows.
Qualys has released the following checks for these new vulnerabilities:
| Microsoft Local Security Authority Subsystem Denial of Service Vulnerability |
|---|
SEVERITY: Critical  4 |
| QUALYS ID: 90571 |
| VENDOR REFERENCE: MS09-069 |
| CVE REFERENCE: CVE-2009-3675 |
| CVSS SCORES: Base 7.5/ Temporal 5.9 |
| THREAT:
This security update resolves a privately reported vulnerability in
Microsoft Windows and addresses the vulnerability by changing the way
that LSASS handles specially crafted requests.
This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003. |
| IMPACT: The vulnerability could allow a denial of service if a remote, authenticated attacker, while communicating through Internet Protocol security (IPsec), sends a specially crafted ISAKMP message to the Local Security Authority Subsystem Service (LSASS) on an affected system. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Windows 2000 Service Pack 4 Windows XP Service Pack 2 and Windows XP Service Pack 3 Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Refer to Microsoft Security Bulletin MS09-069 for further details. |
| Microsoft Active Directory Federation Services Remote Code Execution Vulnerability |
|---|
SEVERITY: Urgent  5 |
| QUALYS ID: 90573 |
| VENDOR REFERENCE: MS09-070 |
| CVE REFERENCE: CVE-2009-2509 |
| CVSS SCORES: Base 7.1/ Temporal 5.6 |
| THREAT:
Active Directory Federation Services is a standards based Web Single
Sign-On (SSO) service.It enables federated identity by implementing
claims based authentication across forests.It is part of Windows Server
2003 R2 and later releases of Microsoft's server Operating System as a
server role.
A Remote Code Execution vulnerability exists in implementations of Microsoft Active Directory Federation Services on Windows Server 2003, Windows Server 2003 x64 Edition, Windows Server 2008, and Windows Server 2008 x64 Edition. The vulnerability is due to incorrect validation of request headers when an authenticated user connects to an ADFS enabled Web server. An attacker who successfully exploited this vulnerability could take complete control of an affected system. Microsoft security update corrects the validation that ADFS-enabled Web servers apply to request headers submitted by a Web client.(CVE-2009-2509) |
| IMPACT: An attacker who successfully exploited this vulnerability could then perform actions on the IIS server with the same rights as the Worker Process Identity (WPI). |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 Refer to Microsoft Security Bulletin MS09-070 for further details. |
| Microsoft Internet Authentication Service Could Allow Remote Code Execution |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 116750 |
| VENDOR REFERENCE: MS09-071 |
| CVE REFERENCE: CVE-2009-2505 | CVE-2009-3677 |
| CVSS SCORES: Base 6.8/ Temporal 5 |
| THREAT: Internet Authentication Service (IAS) is the Microsoft implementation of a Remote Authentication Dial-In User Service. MS09-071 resolves multiple issues with the IAS service - There is a memory corruption issue due to insufficient validation of the Protected Extensible Authentication Protocol (PEAP) authentication requests. (CVE-2009-2505) - There is a privilege elevation issue due to the IAS does not properly validate an MS-CHAP v2 authentication request. (CVE-2009-3677) |
| IMPACT: An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Windows 2000 Service Pack 4 Windows XP Service Pack 2 and Windows XP Service Pack 3 Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista and Windows Vista Service Pack 1 Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1 Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-based Systems Windows Server 2008 for Itanium-based Systems Service Pack 2 Refer to Microsoft Security Bulletin MS09-071 for further details. |
| Microsoft Internet Explorer Cumulative Security Update |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90570 |
| VENDOR REFERENCE: KB977981 |
| CVE REFERENCE: CVE-2009-3762 | CVE-2009-4054 | CVE-2009-2493 | CVE-2009-3671 | CVE-2009-3672 | CVE-2009-3673 | CVE-2009-3674 |
| CVSS SCORES: Base 9.3/ Temporal 7.3 |
| THREAT: Microsoft Internet Explorer is a Web browser for Microsoft Windows.
A remote code execution vulnerability exists in an ActiveX control built with vulnerable Microsoft Active Template Library (ATL) headers. Components and controls built using ATL could allow the instantiation of arbitrary objects that can bypass related security policy, such as kill bits within Internet Explorer. Therefore, this vulnerability could allow a remote, unauthenticated user to perform remote code execution on an affected system. (CVE-2009-2493). A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. (CVE-2009-3671, CVE-2009-3672,CVE-2009-3673,CVE-2009-3674). A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a dangling pointer in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "getElementsByTagName()" method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious Web page.(CVE-2009-4054)
|
| IMPACT: Successfully exploiting this issues will allow remote attackers to execute arbitrary code and gain same user rights as the logged-on user. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Windows 2000 Service Pack 4 (Internet Explorer 5.01 Service Pack 4) Microsoft Windows 2000 Service Pack 4 (Internet Explorer 6 Service Pack 1) Windows XP Service Pack 2 and Windows XP Service Pack 3 (Internet Explorer 6) Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6) Windows Server 2003 Service Pack 2 (Internet Explorer 6) Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6) Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6) Windows XP Service Pack 2 and Windows XP Service Pack 3 (Internet Explorer 7) Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7) Windows Server 2003 Service Pack 2 (Internet Explorer 7) Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7) Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7) Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 (Internet Explorer 7) For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-072. |
| Microsoft WordPad and Office Text Converters Remote Code Execution Vulnerability |
|---|
| SEVERITY: Urgent 5 |
| QUALYS ID: 90572 |
| VENDOR REFERENCE: MS09-073 |
| CVE REFERENCE: CVE-2009-2506 |
| CVSS SCORES: Base 7.6/ Temporal 6 |
| THREAT:
This security update resolves a privately reported vulnerability in
Microsoft WordPad and Microsoft Office text converters and addresses
the vulnerability by correcting the way WordPad and the Office Text
Converters parse Word 97 documents. This security update is rated Important for WordPad on all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003. This security update is also rated Important for all supported editions of Microsoft Office Word 2002 and Microsoft Office Word 2003, Microsoft Office Converter Pack, and Microsoft Works 8.5. |
| IMPACT: The vulnerability could allow remote code execution if a specially crafted Word 97 file is opened in WordPad or Microsoft Office Word. An attacker who successfully exploited this vulnerability could gain the same privileges as the user. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Windows 2000 Service Pack 4 Windows XP Service Pack 2 and Windows XP Service Pack 3 Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Microsoft Office XP Service Pack 3 (Microsoft Office Word 2002 Service Pack 3) Microsoft Office 2003 Service Pack 3 (Microsoft Office Word 2003 Service Pack 3) Microsoft Office Converter Pack Refer to Microsoft Security Bulletin MS09-073 for further details. |
| Microsoft Office Project Could Allow Remote Code Execution |
|---|
| SEVERITY: Urgent 5 |
| QUALYS ID: 110112 |
| VENDOR REFERENCE: MS09-074 |
| CVE REFERENCE: CVE-2009-0102 |
| CVSS SCORES: Base 9.3/ Temporal 6.9 |
| THREAT: Microsoft Project is a project management software program to assist project managers.
A remote code execution vulnerability exists in the way that Microsoft Office Project handles specially crafted Project files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. |
| IMPACT: Successful exploitation of this vulnerability allows an attacker to execute arbitrary code and take complete conttol of an affected system. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Project 2000 Service Release 1 Microsoft Project 2002 Service Pack 1 Microsoft Office Project 2003 Service Pack 3 Refer to Microsoft Security Bulletin MS09-074 for further details. |
This new vulnerability check is included in Qualys vulnerability signatures v1.24.71-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.
SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
- Enable the following Qualys IDs:
- 90571
- 90573
- 116750
- 90570
- 90572
- 110112
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
Access for QualysGuard customers: https://qualysguard.qualys.com
Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/
