August 10, 2010
Microsoft Security Bulletin: August 2010
Advisory Overview

August 10, 2010 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 15 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.

Vulnerability Details

Microsoft has released 15 security patches to fix newly discovered flaws in Microsoft Windows.

Qualys has released the following checks for these new vulnerabilities:


Microsoft Windows Shell Remote Code Execution Vulnerability (MS10-046 and KB2286198)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90616
VENDOR REFERENCE: KB2286198
CVE REFERENCE: CVE-2010-2568
CVSS SCORES: Base 9.3/ Temporal 7.3
THREAT: Microsoft Windows is prone to a vulnerability that may allow a file to automatically run because the software fails to handle "LNK" files properly.

The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut.

The attacker must entice a victim into attaching a form of removable media, such as a USB drive or CD-ROM.

Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 1
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 1
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems

Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.
For details see: http://www.qualys.com/research/exploits/#KB2286198

IMPACT: Successfully exploiting this vulnerability might allow an attacker to execute arbitrary code.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS10-046 for further details on patches and workarounds.

Workarounds:
1) Disable the displaying of icons for shortcuts

Impact of workaround #1: Disabling icons from being displayed for shortcuts prevents the issue from being exploited on affected systems. When this workaround is implemented, shortcut files and Internet Explorer shortcuts will no longer have an icon displayed.

2) Disabling the WebClient service helps protect affected systems from attempts to exploit this vulnerability by blocking the most likely remote attack vector through the Web Distributed Authoring and Versioning (WebDAV) client service.

Impact of workaround #2: When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the Web Client service will not start, and an error message will be logged in the System log.

3) Blocking the download of LNK and PIF files on the Internet Gateway provides protection against remote exploitation of these attacks.


Microsoft Windows Kernel Elevation of Privilege Vulnerability (MS10-047)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90619
VENDOR REFERENCE: MS10-047
CVE REFERENCE: CVE-2010-1888 | CVE-2010-1889 | CVE-2010-1890
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling. The kernel is prone to the following vulnerabilities:

An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel deals with specific thread creation attempts. (CVE-2010-1888)

An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel initializes objects while handling certain errors. (CVE-2010-1889)

A denial of service vulnerability exists in the way that the Windows kernel validates access control lists on kernel objects. (CVE-2010-1890)

Affected Operating Systems:
Windows XP Service Pack 3
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems

IMPACT: An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode or cause system to become unresponsive and automatically restart . An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS10-047 for further details.


Microsoft Windows Kernel-Mode Drivers Privilege Elevation Vulnerability (MS10-048)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90627
VENDOR REFERENCE: MS10-048
CVE REFERENCE: CVE-2010-1887 | CVE-2010-1894 | CVE-2010-1895 | CVE-2010-1896 | CVE-2010-1897
CVSS SCORES: Base 6.8/ Temporal 5
THREAT: The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling. The kernel is prone to the following vulnerabilities:

A denial of service vulnerability exists because the Windows kernel-mode drivers do not properly validate an argument passed to a system call.

An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly handle certain exceptions.

An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly allocate memory when copying data from user mode.

An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly validate input passed from user mode.

The Windows kernel-mode drivers do not properly validate pseudo handles within callback parameters when creating a new window allowing privilege escalation attacks to be conducted.

Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which Windows kernel-mode drivers handle exceptions, allocate memory, and validate system call arguments, user-mode input, and new window callback parameters.

IMPACT: Successful exploitation could allow an attacker to run code or to elevate the attacker's user rights. An attacker could also cause the affected system to stop responding and automatically restart.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS10-048 for further details.


Microsoft Windows SChannel Remote Code Execution Vulnerability (MS10-049)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90621
VENDOR REFERENCE: MS10-049
CVE REFERENCE: CVE-2010-2566 | CVE-2009-3555
CVSS SCORES: Base / Temporal
THREAT: The Secure Channel (SChannel) security package is a Security Support Provider (SSP) that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) Internet standard authentication protocols. It is prone to the following vulnerabilities:

A spoofing vulnerability exists in the TLS/SSL protocol, implemented in the Microsoft Windows SChannel authentication component.

A remote code execution vulnerability exists in the way that SChannel on a client machine validates a certificate request message sent by the server.

Microsoft has released a security update that addresses the vulnerabilities by implementing RFC 5746 and additional validation on SSL responses returned by a server.

This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003; and Important for all supported editions of Windows Vista, Windows Server2008, Windows 7, and Windows Server 2008 R2.

IMPACT: The more severe of these vulnerabilities could allow remote code execution if a user visits a specially crafted Web site that is designed to exploit these vulnerabilities through an Internet Web browser. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger message that takes them to the attacker's Web site.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS10-049 for further details.

Workarounds:
- Enable SSLAlwaysNegoClientCert on IIS 6 and above.

Impact of the workaround: Setting this flag will require the client to authenticate prior to loading any element from the SSL-protected web site. This will cause the browser to always prompt the user for a client certificate upon connecting to the SSL protected web site.

Refer to the advisory to obtain detailed instructions on applying the workaround.


Microsoft Windows Movie Maker Remote Code Execution Vulnerability (MS10-050)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90623
VENDOR REFERENCE: MS10-050
CVE REFERENCE: CVE-2010-2566
CVSS SCORES: Base 9/ Temporal 7.1
THREAT: Windows Movie Maker is an application that allows users to create, edit and add special effects to home movies.

A remote code execution vulnerability exists in the way that Windows Movie Maker handles specially crafted project files. This vulnerability requires a malicious user to send a specially crafted Movie Maker file and convince the user to open the specially crafted file.

Microsoft has released a security update that addresses the vulnerability by changing the way that Windows Movie Maker parses Movie Maker project files.

This security update is rated Important for Windows Movie Maker 2.1, Windows Movie Maker 2.6, and Windows Movie Maker 6.0.

IMPACT: Successful exploitation could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Movie Maker 2.1)

Windows XP Professional x64 Edition Service Pack 2 (Movie Maker 2.1)

Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Movie Maker 6.0[1])

Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Movie Maker 2.6[2])

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Movie Maker 6.0[1])

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Movie Maker 2.6[2])

Refer to Microsoft Security Bulletin MS10-050 for further details.

Workaround:
- Remove the Movie Maker .MSWMM file association.

Impact of the workaround: Double-clicking an MSWMM file will no longer launch Windows Movie Maker.

Refer to the advisory to obtain detailed instructions on applying the workaround.


Microsoft Windows XML Core Services Remote Code Execution Vulnerability (MS10-051)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90625
VENDOR REFERENCE: MS10-051
CVE REFERENCE: CVE-2010-2561
CVSS SCORES: Base 9.3/ Temporal 7.3
THREAT: A remote code execution vulnerability exists in the way that Microsoft XML Core Services handles HTTP responses.

Microsoft has released a security update that addresses the vulnerability by ensuring that HTTP responses are handled correctly by MSXML.

This security update is rated Critical for Microsoft XML Core Services 3.0 on all supported releases of Windows XP, Windows Vista, and Windows 7; and Moderate for Microsoft XML Core Services 3.0 on all supported releases of Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2.

IMPACT: The vulnerability could allow remote code execution if a user browses a Web site that contains specially crafted content or opens specially crafted HTML e-mail. An attacker who successfully exploits this vulnerability could take complete control of an affected system.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Microsoft XML Core Services 3.0)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Server 2003 Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft XML Core Services 3.0)

Windows Vista Service Pack 1 (Microsoft XML Core Services 3.0)

Windows Vista Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Vista x64 Edition Service Pack 1 (Microsoft XML Core Services 3.0)

Windows Vista x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Server 2008 for 32-bit Systems (Microsoft XML Core Services 3.0)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Server 2008 for x64-based Systems (Microsoft XML Core Services 3.0)

Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Server 2008 for Itanium-based Systems (Microsoft XML Core Services 3.0)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS10-051.

Workarounds:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

3) Restrict Web sites to only your trusted Web sites.

Refer to the advisory to obtain additional details on applying the workarounds.


Microsoft MPEG Layer-3 Codecs Remote Code Execution Vulnerability (MS10-052)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90629
VENDOR REFERENCE: MS10-052
CVE REFERENCE: CVE-2010-1882
CVSS SCORES: Base 7.5/ Temporal 5.5
THREAT: The MPEG Layer-3 audio codec is delivered as part of Windows Media and as a part of the Windows operating system. A vulnerability exists in the Microsoft MPEG Layer-3 audio codecs when a user opens a specially crafted media file or receives a crafted streaming content.

Microsoft has released a security update that addresses the vulnerability by correcting the way that the Microsoft MPEG Layer-3 audio codecs handle the MPEG Layer-3 audio stream in specially crafted media files.

This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003 (except supported Itanium-based editions).

IMPACT: Successful exploitation of this vulnerability could allow remote code execution.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Refer to Microsoft Security Bulletin MS10-052 for further details.

Workarounds:
1) Unregister l3codecx.ax

2) Deny access to l3codecx.ax

3) Disable MPEG Layer-3 parsing in DirectShow

Impact of workarounds: MPEG Layer-3 Parsing is disabled in applications that use DirectShow to play MPEG Layer-3 content.

Refer to the advisory to obtain detailed instructions on applying the workarounds.


Microsoft Internet Explorer Cumulative Security Update (MS10-053)
SEVERITY: Critical Critical-4 4
QUALYS ID: 100089
VENDOR REFERENCE: MS10-053
CVE REFERENCE: CVE-2010-1258 | CVE-2010-2556 | CVE-2010-2557 | CVE-2010-2558 | CVE-2010-2559 | CVE-2010-2560
CVSS SCORES: Base 7.6/ Temporal 5.6
THREAT: Microsoft Internet Explorer is a Web browser for Microsoft Windows.

Internet Explorer is prone to the following vulnerabilities:

An information disclosure vulnerability exists because Internet Explorer incorrectly interprets the origin of script, allowing the script to run in the context of a domain or Internet Explorer security zone other than where it originated. (CVE-2010-1258)

Multiple remote code execution vulnerabilities exist in the way Internet Explorer attempts to access an object that has not been initialized or has been deleted. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2556,CVE-2010-2557)

A remote code execution vulnerability exists in the way Internet Explorer attempts to access an object that may have been corrupted due to a race condition. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2558)

A HTML layout memory corruption vulnerability exists in the way Internet Explorer attempts to access incorrectly initialized memory under certain conditions. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2560)

Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Internet Explorer enforces security checks and handles objects in memory.

IMPACT: Successful exploitation can allow a remote attacker to execute arbitrary code.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Internet Explorer 6)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 Service Pack 2 (Internet Explorer 6)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

Windows XP Service Pack 3 (Internet Explorer 7)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 Service Pack 2 (Internet Explorer 7)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Internet Explorer 7)

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS10-053.

Workarounds:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

Refer to the advisory to obtain additional details on applying the workarounds.


Microsoft Windows SMB Server Remote Code Execution Vulnerability (MS10-054)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90626
VENDOR REFERENCE: MS10-054
CVE REFERENCE: CVE-2010-2550 | CVE-2010-2551 | CVE-2010-2552
CVSS SCORES: Base 9.3/ Temporal 8.1
THREAT: Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol used in Microsoft Windows. Microsoft Windows SMB Server is prone to the following vulnerabilities:

An unauthenticated remote code execution vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB packets. (CVE-2010-2550)

A denial of service vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB packets. (CVE-2010-2551)

A denial of service vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB compounded requests. (CVE-2010-2552)

Microsoft has released a security update that addresses these vulnerabilities by correcting the way that SMB validates SMB requests.

This security update is rated Critical for all supported editions of Windows XP and Important for all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

IMPACT: An attempt to exploit the vulnerability would not require authentication, allowing an attacker to exploit the vulnerability by sending a specially crafted network message to a computer running the Server service.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS10-054 for further details.

Workaround:
1) TCP ports 139 and 445 should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability.

Impact of workaround #1: Blocking the ports can cause several windows services or applications using those ports to stop functioning.

Refer to the advisory to obtain additional details on applying the workarounds.


Microsoft Windows Cinepak Codec Remote Code Execution Vulnerability (MS10-055)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90622
VENDOR REFERENCE: MS10-055
CVE REFERENCE: CVE-2010-2553
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: The Cinepak codec is a media encoder and decoder supported by the Windows Media Player. This codec allows bitstream encoding and decoding for media files.

Cinepack codec is prone to a vulnerability because it does not properly handle specially crafted media files.

The vulnerability could allow remote code execution if a user opens a specially crafted media file or receives specially crafted streaming content from a Web site or any application that delivers Web content.

Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Cinepak code decompresses media files.

This security update is rated Critical for all supported editions of Windows XP, Windows Vista, and Windows 7.

IMPACT: Successfully exploiting this vulnerability could allow a remote attacker to gain the same user rights as the local user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Refer to Microsoft Security Bulletin MS10-055 for further details.

Workarounds:
1) Modify the Access Control List (ACL) on iccvid.dll.

Impact of workaround #1: IMedia files encoded using the Cinepak codec will fail to play in multimedia.

2) Disable the parsing of Cinepac encoded files in DirectShow.

Impact of workaround #2: MPEG Layer-3 Parsing is disabled in applications that use DirectShow to play MPEG Layer-3 content.

3) Unregister quartz.dll.

Impact of workaround #3: Windows Media Player will not be able to play .AVI or .WAV files.

Refer to the advisory to obtain additional details on applying the workarounds.


Microsoft Office Word Remote Code Execution Vulnerability (MS10-056)
SEVERITY: Critical Critical-4 4
QUALYS ID: 110129
VENDOR REFERENCE: MS10-056
CVE REFERENCE: CVE-2010-1900 | CVE-2010-1901 | CVE-2010-1902 | CVE-2010-1903
CVSS SCORES: Base 7.6/ Temporal 6.6
THREAT: Microsoft Word is a proprietary word processing application written and distributed by Microsoft for Microsoft Windows and Mac OS X. Word is prone to the following vulnerabilities:

A remote code execution vulnerability exists in the way that Microsoft Office Word handles malformed records inside a specially crafted Word file. (CVE-2010-1900)

A remote code execution vulnerability exists in the way that Microsoft Office Word parses rich text data. (CVE-2010-1901,CVE-2010-1902)

A remote code execution vulnerability exists in the way that Microsoft Office Word handles a specially crafted Word file that includes a malformed record. (CVE-2010-1903)

Microsoft has released an update that addresses the vulnerabilities by modifying the way that Microsoft Office Word opens specially crafted Word files and by modifying the way that Word handles certain properties of rich text data.

This security update is rated Critical for all supported editions of Microsoft Office Word 2007. This security update is also rated Important for all supported editions of Microsoft Office Word 2002, Microsoft Office Word 2003, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac; Open XML File Format Converter for Mac; Works 9; and all supported versions of Microsoft Office Word Viewer and Microsoft Office Compatibility Pack.

IMPACT: An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Office XP Service Pack 3 (Microsoft Office Word 2002 Service Pack 3)

Microsoft Office 2003 Service Pack 3 (Microsoft Office Word 2003 Service Pack 3)

2007 Microsoft Office System Service Pack 2 (Microsoft Office Word 2007 Service Pack 2)

Microsoft Office 2004 for Mac

Microsoft Office 2008 for Mac

Open XML File Format Converter for Mac

Microsoft Office Word Viewer

Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2

Microsoft Works 9

Refer to Microsoft Security Bulletin MS10-056 for further details.

Workarounds:
1) Avoid opening Word files received from un-trusted sources.

2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or un-trusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

Impact of workaround #2:
Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

3) Microsoft Office File Block policy should be used to block the opening of RTF and earlier documents from unknown or untrusted sources.

Impact of the workaround #3:
If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

4) Read e-mails in plain text.

Refer to the advisory to obtain additional details on applying the workarounds.


Microsoft Excel Remote Code Execution Vulnerabilities (MS10-057)
SEVERITY: Critical Critical-4 4
QUALYS ID: 110130
VENDOR REFERENCE: MS10-057
CVE REFERENCE: CVE-2010-2562
CVSS SCORES: Base 10/ Temporal 7.4
THREAT: Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft.

Microsoft Excel is vulnerable to a remote code execution vulnerability due to a memory corruption issue. This can occur if the user opens a specially crafted Excel file.

IMPACT: Successful exploitation allows remote code execution. An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: N/A

Microsoft Windows TCP/IP Elevation of Privilege Vulnerability (MS10-058)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90620
VENDOR REFERENCE: MS10-058
CVE REFERENCE: CVE-2010-1893 | CVE-2010-1892
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. The following vulnerabilities exist in TCP/IP processing in Windows.

A denial of service vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of specially crafted IPv6 packets with a malformed extension header. An attacker could exploit the vulnerability by sending the target system a small number of specially crafted packets, causing the affected system to stop responding. (CVE-2010-1892)

An elevation of privilege vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of a specific input buffer. An attacker who successfully exploited this vulnerability could run arbitrary code with system-level privileges. (CVE-2010-1893)

Affected Operating Systems:
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for Itanium-based Systems

IMPACT: An attacker who successfully exploits this vulnerability could run arbitrary code with system-level privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS10-058 for further details.


Microsoft Windows Tracing Feature for Services Privilege Elevation Vulnerability (MS10-059)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90628
VENDOR REFERENCE: MS10-059
CVE REFERENCE: CVE-2010-2554 | CVE-2010-2555
CVSS SCORES: Base 6.6/ Temporal 4.9
THREAT: The Windows Tracing Feature for Services is vulnerable to the following vulnerabilities:

An elevation of privilege vulnerability exists when Windows places incorrect access control lists (ACLs) on the registry keys for the Tracing Feature for Services. (CVE-2010-2554)

An elevation of privilege vulnerability exists due to the way that the Tracing Feature for Services allocates memory when processing specially crafted long strings from the registry. (CVE-2010-2555)

Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which tokens are obtained and the length of a string read from the registry is calculated.

This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

IMPACT: An attacker who successfully exploits these vulnerabilities could run arbitrary code with system-level privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS10-059 for further details.


Microsoft .NET Common Language Runtime and Silverlight Remote Code Execution Vulnerabilities (MS10-060)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90624
VENDOR REFERENCE: MS10-060
CVE REFERENCE: CVE-2010-0019 | CVE-2010-1898
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: Microsoft .NET Framework and Microsoft Silverlight are exposed to two vulnerabilities.

The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications, or if an attacker succeeds in convincing a user to run a specially crafted Microsoft .NET application.

The vulnerabilities could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and executing the page, as could be the case in a Web hosting scenario.

Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Microsoft Silverlight handles pointers and Microsoft .NET CLR handles interfaces.

This security update is rated Critical for all affected releases of Microsoft .NET Framework for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2; Microsoft Silverlight 2; and Microsoft Silverlight 3.

IMPACT: Successful exploitation of this vulnerability allows an attacker to execute arbitrary code.
SOLUTION: Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Microsoft .NET Framework 3.5)

Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 3.5)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 3.5)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)

Windows Vista Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS10-060.

Workarounds:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

3) Temporarily prevent the Microsoft Silverlight ActiveX control from running in Internet Explorer, Chrome and Firefox.

Impact of workaround #3: Applications and Web sites that require the Microsoft Silverlight ActiveX control may no longer function correctly.

4) Disable partially trusted Microsoft .NET applications.

Impact of workaround #4: Some Microsoft .NET applications will not run.

5) Disable XAML browser applications in Internet Explorer.

Impact of workaround #5: Impact of workaround. Microsoft .NET code will not run in Internet Explorer or will not run without a prompt.

This new vulnerability check is included in Qualys vulnerability signatures v1.27.15-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 90616
    • 90619
    • 90627
    • 90621
    • 90623
    • 90625
    • 90629
    • 100089
    • 90626
    • 90622
    • 110129
    • 110130
    • 90620
    • 90628
    • 90624
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/