December 08, 2009
Microsoft Security Bulletin: December 2009 Security Bulletin
Advisory Overview

December 8, 2009 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 6 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.

Vulnerability Details

Microsoft has released 6 security patches to fix newly discovered flaws in Microsoft Windows.

Qualys has released the following checks for these new vulnerabilities:


Microsoft Local Security Authority Subsystem Denial of Service Vulnerability
SEVERITY: Critical Critical-4 4
QUALYS ID: 90571
VENDOR REFERENCE: MS09-069
CVE REFERENCE: CVE-2009-3675
CVSS SCORES: Base 7.5/ Temporal 5.9
THREAT: This security update resolves a privately reported vulnerability in Microsoft Windows and addresses the vulnerability by changing the way that LSASS handles specially crafted requests.

This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003.

IMPACT: The vulnerability could allow a denial of service if a remote, authenticated attacker, while communicating through Internet Protocol security (IPsec), sends a specially crafted ISAKMP message to the Local Security Authority Subsystem Service (LSASS) on an affected system.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4

Windows XP Service Pack 2 and Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS09-069 for further details.


Microsoft Active Directory Federation Services Remote Code Execution Vulnerability
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90573
VENDOR REFERENCE: MS09-070
CVE REFERENCE: CVE-2009-2509
CVSS SCORES: Base 7.1/ Temporal 5.6
THREAT: Active Directory Federation Services is a standards based Web Single Sign-On (SSO) service.It enables federated identity by implementing claims based authentication across forests.It is part of Windows Server 2003 R2 and later releases of Microsoft's server Operating System as a server role.

A Remote Code Execution vulnerability exists in implementations of Microsoft Active Directory Federation Services on Windows Server 2003, Windows Server 2003 x64 Edition, Windows Server 2008, and Windows Server 2008 x64 Edition.

The vulnerability is due to incorrect validation of request headers when an authenticated user connects to an ADFS enabled Web server. An attacker who successfully exploited this vulnerability could take complete control of an affected system.

Microsoft security update corrects the validation that ADFS-enabled Web servers apply to request headers submitted by a Web client.(CVE-2009-2509)

IMPACT: An attacker who successfully exploited this vulnerability could then perform actions on the IIS server with the same rights as the Worker Process Identity (WPI).
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS09-070 for further details.


Microsoft Internet Authentication Service Could Allow Remote Code Execution
SEVERITY: Critical Critical-4 4
QUALYS ID: 116750
VENDOR REFERENCE: MS09-071
CVE REFERENCE: CVE-2009-2505 | CVE-2009-3677
CVSS SCORES: Base 6.8/ Temporal 5
THREAT: Internet Authentication Service (IAS) is the Microsoft implementation of a Remote Authentication Dial-In User Service.
MS09-071 resolves multiple issues with the IAS service

- There is a memory corruption issue due to insufficient validation of the Protected Extensible Authentication Protocol (PEAP) authentication requests. (CVE-2009-2505)

- There is a privilege elevation issue due to the IAS does not properly validate an MS-CHAP v2 authentication request. (CVE-2009-3677)

IMPACT: An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4

Windows XP Service Pack 2 and Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista and Windows Vista Service Pack 1

Windows Vista Service Pack 2

Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems

Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS09-071 for further details.


Microsoft Internet Explorer Cumulative Security Update
SEVERITY: Critical Critical-4 4
QUALYS ID: 90570
VENDOR REFERENCE: KB977981
CVE REFERENCE: CVE-2009-3762 | CVE-2009-4054 | CVE-2009-2493 | CVE-2009-3671 | CVE-2009-3672 | CVE-2009-3673 | CVE-2009-3674
CVSS SCORES: Base 9.3/ Temporal 7.3
THREAT: Microsoft Internet Explorer is a Web browser for Microsoft Windows.

A remote code execution vulnerability exists in an ActiveX control built with vulnerable Microsoft Active Template Library (ATL) headers. Components and controls built using ATL could allow the instantiation of arbitrary objects that can bypass related security policy, such as kill bits within Internet Explorer. Therefore, this vulnerability could allow a remote, unauthenticated user to perform remote code execution on an affected system. (CVE-2009-2493).

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. (CVE-2009-3671, CVE-2009-3672,CVE-2009-3673,CVE-2009-3674).

A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a dangling pointer in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "getElementsByTagName()" method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious Web page.(CVE-2009-4054)

IMPACT: Successfully exploiting this issues will allow remote attackers to execute arbitrary code and gain same user rights as the logged-on user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4 (Internet Explorer 5.01 Service Pack 4)

Microsoft Windows 2000 Service Pack 4 (Internet Explorer 6 Service Pack 1)

Windows XP Service Pack 2 and Windows XP Service Pack 3 (Internet Explorer 6)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 Service Pack 2 (Internet Explorer 6)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

Windows XP Service Pack 2 and Windows XP Service Pack 3 (Internet Explorer 7)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 Service Pack 2 (Internet Explorer 7)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 (Internet Explorer 7)

Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-072.


Microsoft WordPad and Office Text Converters Remote Code Execution Vulnerability
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90572
VENDOR REFERENCE: MS09-073
CVE REFERENCE: CVE-2009-2506
CVSS SCORES: Base 7.6/ Temporal 6
THREAT: This security update resolves a privately reported vulnerability in Microsoft WordPad and Microsoft Office text converters and addresses the vulnerability by correcting the way WordPad and the Office Text Converters parse Word 97 documents.

This security update is rated Important for WordPad on all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003. This security update is also rated Important for all supported editions of Microsoft Office Word 2002 and Microsoft Office Word 2003, Microsoft Office Converter Pack, and Microsoft Works 8.5.

IMPACT: The vulnerability could allow remote code execution if a specially crafted Word 97 file is opened in WordPad or Microsoft Office Word. An attacker who successfully exploited this vulnerability could gain the same privileges as the user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4

Windows XP Service Pack 2 and Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Microsoft Office XP Service Pack 3 (Microsoft Office Word 2002 Service Pack 3)

Microsoft Office 2003 Service Pack 3 (Microsoft Office Word 2003 Service Pack 3)

Microsoft Works 8.5

Microsoft Office Converter Pack

Refer to Microsoft Security Bulletin MS09-073 for further details.


Microsoft Office Project Could Allow Remote Code Execution
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 110112
VENDOR REFERENCE: MS09-074
CVE REFERENCE: CVE-2009-0102
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: Microsoft Project is a project management software program to assist project managers.

A remote code execution vulnerability exists in the way that Microsoft Office Project handles specially crafted Project files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

IMPACT: Successful exploitation of this vulnerability allows an attacker to execute arbitrary code and take complete conttol of an affected system.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Project 2000 Service Release 1

Microsoft Project 2002 Service Pack 1

Microsoft Office Project 2003 Service Pack 3

Refer to Microsoft Security Bulletin MS09-074 for further details.

This new vulnerability check is included in Qualys vulnerability signatures v1.24.71-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 90571
    • 90573
    • 116750
    • 90570
    • 90572
    • 110112
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/