February 08, 2011
Microsoft Security Bulletin: February 2011
Advisory Overview

February 8, 2011 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations from vulnerabilities that were fixed today in 13 security advisories by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.

Vulnerability Details

Microsoft has released 13 security patches to fix newly discovered flaws in Microsoft products.

Qualys has released the following checks for these new vulnerabilities:


Microsoft Internet Explorer Remote Code Execution Vulnerability (MS11-003 and KB2488013)
SEVERITY: Critical Critical-4 4
QUALYS ID: 100096
VENDOR REFERENCE: KB2488013
CVE REFERENCE: CVE-2010-3971 | CVE-2011-0035 | CVE-2011-0036 | CVE-2011-0038
CVSS SCORES: Base 0/ Temporal 0
THREAT: Microsoft Internet Explorer is a Web browser available for Microsoft Windows.

Microsoft Internet Explorer is exposed to a use-after-free vulnerability. The vulnerability is triggered when the applications tries to parse a specifically crafted "css" file. (CVE-2010-3971)

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. (CVE-2011-0035,CVE-2011-0036)

A remote code execution vulnerability exists in the way that Internet Explorer handles the loading of DLL files. (CVE-2011-0038)

Affected Versions:
Internet Explorer 6, 7 and 8 are affected.

IMPACT: Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code or cause denial of service.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Internet Explorer 6)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 Service Pack 2 (Internet Explorer 6)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

Windows XP Service Pack 3 (Internet Explorer 7)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 Service Pack 2 (Internet Explorer 7)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Internet Explorer 7)

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-003.

Workarounds:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

3) Prevent the recursive loading of Cascading Style Sheets (CSS) in Internet Explorer


Microsoft Internet Information Services (IIS) FTP Service Remote Code Execution Vulnerability (MS11-004)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90673
VENDOR REFERENCE: MS11-004
CVE REFERENCE: CVE-2010-3972
CVSS SCORES: Base 0/ Temporal 0
THREAT: Microsoft Internet Information Service is a Web server available for Microsoft Windows.

A remote code execution vulnerability exists in the FTP Service in Microsoft Internet Information Services 7.0 and Microsoft Internet Information Services 7.5. An attacker could exploit this vulnerability by sending a specially crafted FTP command to the FTP server.

Microsoft has released a security update that resolves this vulnerability by modifying the way the IIS FTP Service handles specially crafted FTP commands.

This security update is rated Important for Microsoft FTP Service 7.0 for IIS 7.0 and Microsoft FTP Service 7.5 for IIS 7.0 when installed on all supported editions of Windows Vista and Windows Server 2008, and for Microsoft FTP Service 7.5 for Internet Information Services 7.5 on all supported editions of Windows 7 and Windows Server 2008 R2.

IMPACT: An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts in the context of the local system.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

Windows 7 for 32-bit Systems (Microsoft FTP Service 7.5 for IIS 7.5)

Windows 7 for x64-based Systems (Microsoft FTP Service 7.5 for IIS 7.5)

Windows Server 2008 R2 for x64-based Systems (Microsoft FTP Service 7.5 for IIS 7.5)

Windows Server 2008 R2 for Itanium-based Systems (Microsoft FTP Service 7.5 for IIS 7.5)

Refer to Microsoft Security Bulletin MS11-004 for further details.

Workaround:
1) Stop and disable the FTP Service

Impact of workaround #1: Impact of workaround. Clients will not be able to connect to the FTP server and upload or download files using the FTP Service.

2) Block FTP inbound traffic at the edge firewall

Impact of workaround #2: Applications and services may use the affected port. Blocking connectivity to the port may cause various applications or services to not function.


Microsoft Windows Active Directory Denial of Service Vulnerability (MS11-005)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90683
VENDOR REFERENCE: MS11-005
CVE REFERENCE: CVE-2011-0040
CVSS SCORES: Base 7.8/ Temporal 6.1
THREAT: Active Directory provides central authentication and authorization services for Windows-based computers. Active Directory Lightweight Directory Services is an independent mode of Active Directory that provides dedicated directory services for applications.

A denial of service vulnerability exists in implementations of Microsoft Windows Active Directory due to improper validation of service principal names (SPN), which could result in SPN collisions. When this occurs, services that use the SPN will downgrade to NT LAN Manager if configured to negotiate. Services that are not configured to negotiate will become unavailable, resulting in a denial of service. (CVE-2011-0040)

Microsoft has released a security update that addresses the vulnerability by correcting the way the Active Directory server handles SPN update requests.

This security update is rated Important for Active Directory on all supported editions of Windows Server 2003.

IMPACT: Successfully exploiting this vulnerability might allow a remote attacker to cause denial of service.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Server 2003 Service Pack 2 (Active Directory)

Windows Server 2003 x64 Edition Service Pack 2 (Active Directory)

Windows Server 2003 with SP2 for Itanium-based Systems (Active Directory)

Refer to Microsoft Security Bulletin MS11-005 for further details.


Microsoft Windows Picture and Fax Viewer Library "shimgvw.dll" Integer Overflow Vulnerability (MS11-006)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90678
VENDOR REFERENCE: MS11-006
CVE REFERENCE: CVE-2010-3970
CVSS SCORES: Base 9.3/ Temporal 7.3
THREAT: The Windows Picture and Fax Viewer "shimgvw.dll" library is used by Windows Explorer to generate thumbnail previews for media files.

An integer overflow vulnerability exists in the "shimgvw" library. During the processing of an image within the "ConvertDIBSECTIONToThumbnail" function, a bitmap containing a large "biWidth" value can be used to cause an integer calculation overflow. This condition can lead to the overflow of a heap buffer and may result in the execution of arbitrary code on the targeted host.

Affected Versions:
Microsoft Windows XP SP3. Previous versions may also be affected.

Previously, this was an iDefense exclusive vulnerability with iDefense ID: 631544

Microsoft released security update MS11-006 to patch this issue.

IMPACT: Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS11-006 for further details.

Workarounds:
1) Modify the Access Control List (ACL) on shimgvw.dll on Windows XP and Windows Server 2003 systems. Refer to Microsoft Knowledge Base Article 2483185 to use the automated Microsoft Fix it solution to enable or disable this workaround.

Impact of workaround #1: Media files typically handled by the Windows Shell graphics processor will not be displayed properly.

2) Disable viewing of thumbnails in Windows Explorer on Windows Vista and Windows Server 2008 systems.

Impact of workaround #2: Windows Explorer will not display thumbnail images.


Microsoft Windows Shell Graphics Processing Remote Code Execution Vulnerability (MS11-006 and KB2490606)
SEVERITY: Serious Serious-3 3
QUALYS ID: 118888
VENDOR REFERENCE: KB2490606
CVE REFERENCE: CVE-2010-3970
CVSS SCORES: Base 0/ Temporal 0
THREAT: The Windows user interface provides users with access to a wide variety of objects necessary for running applications and managing the operating system.

Windows Shell Graphics is prone to a vulnerability that could allow remote code execution if a user views a specially crafted thumbnail image.

Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Windows Shell graphics processor parses thumbnail images.

This security update is rated Critical for all supported editions of Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.

IMPACT: An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the logged on user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be impacted less than users who operate with administrative user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS11-006 for further details.

Workarounds:
1) Modify the Access Control List (ACL) on shimgvw.dll on Windows XP and Windows Server 2003 systems. Refer to Microsoft Knowledge Base Article 2483185 to use the automated Microsoft Fix it solution to enable or disable this workaround.

Impact of workaround #1: Media files typically handled by the Windows Shell graphics processor will not be displayed properly.

2) Disable viewing of thumbnails in Windows Explorer on Windows Vista and Windows Server 2008 systems.

Impact of workaround #2: Windows Explorer will not display thumbnail images.


Microsoft OpenType Compact Font Format (CFF) Driver Remote Code Execution Vulnerability (MS11-007)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90685
VENDOR REFERENCE: MS11-007
CVE REFERENCE: CVE-2011-0033
CVSS SCORES: Base 10/ Temporal 7.4
THREAT: OpenType is a font format developed jointly by Microsoft and Adobe as an extension of Apple's TrueType font format. An OpenType CFF font is an OpenType font that contains PostScript Type 1 outlines. OpenType fonts can contain either PostScript Type 1 or TrueType outlines.

A remote code execution vulnerability exists in the way that the Windows OpenType Compact Font Format (CFF) driver improperly parses specially crafted OpenType fonts. (CVE-2011-0033)

Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Windows OpenType Compact Font Format (CFF) driver validates the parameter values of specially crafted OpenType fonts.

This security update is rated Critical for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

IMPACT: An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS11-007 for further details.

Workarounds:
1) Disable the Preview Pane and Details Pane in Windows Explorer.

Impact of workaround #1: Windows Explorer will not automatically display OTF fonts.

2) Disable the WebClient service.

Impact of workaround #2: When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the WebClient service will not start, and an error message will be logged in the System log.


Microsoft Office Visio Remote Code Execution Vulnerability (MS11-008)
SEVERITY: Critical Critical-4 4
QUALYS ID: 110142
VENDOR REFERENCE: MS11-008
CVE REFERENCE: CVE-2011-0092 | CVE-2011-0093
CVSS SCORES: Base 7.6/ Temporal 5.6
THREAT: Microsoft Visio is diagramming software for Microsoft Windows. It uses vector graphics to create diverse diagrams.

Microsoft Office Visio is prone to the following vulnerabilities that result in remote code execution:

A remote code execution vulnerability exists due to the application not properly validating objects in memory when parsing crafted Visio files. (CVE-2011-0092)

A remote code execution vulnerability exists due to the application not properly handling corrupted structures when opening crafted Visio files. (CVE-2011-0093)

Microsoft has released a security update that addresses the vulnerabilities by correcting the way that Microsoft Visio handles corrupted structures and objects in memory when parsing specially crafted Visio files.

The security update is rated Important for all supported editions of Microsoft Visio 2002, Visio 2003 and Visio 2007.

IMPACT: An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Visio 2002 Service Pack 2

Microsoft Visio 2003 Service Pack 3

Microsoft Visio 2007 Service Pack 2

Refer to Microsoft Security Bulletin MS11-008 for further details.

Workarounds:
1) Restrict Access to ORMELEMS.DLL.

Impact of workaround #1: Users will not be able to use the Database Modeling feature in Visio.

2) Disable Add-ins in Microsoft Visio 2007.

Impact of workaround #2: Functionality that relies on Visio add-ins will not work.

3) Do not open Office files from untrusted sources.


Microsoft JScript and VBScript Scripting Engines Information Disclosure Vulnerability (MS11-009)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90681
VENDOR REFERENCE: MS11-009
CVE REFERENCE: CVE-2011-0031
CVSS SCORES: Base 7.6/ Temporal 6
THREAT: JScript and VBScript are interpreted, object-based scripting languages.

An information disclosure vulnerability exists due to the way that the JScript and VBScript scripting engines process scripts in Web pages. When the scripting engine attempts to load the decoded script into memory in order to run it, memory corruption can occur.

Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the JScript and VBScript scripting engines process scripts in Web pages.

This security update is rated Important for all supported editions of Windows 7 and Moderate for all supported editions of Windows Server 2008 R2.

IMPACT: The vulnerability could allow information disclosure if a user visited a specially crafted Web site.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows 7 for 32-bit Systems (JScript 5.8)

Windows 7 for 32-bit Systems (VBScript 5.8)

Windows 7 for x64-based Systems (JScript 5.8)

Windows 7 for x64-based Systems (VBScript 5.8)

Windows Server 2008 R2 for x64-based Systems (JScript 5.8)

Windows Server 2008 R2 for x64-based Systems (VBScript 5.8)

Windows Server 2008 R2 for Itanium-based Systems (JScript 5.8)

Windows Server 2008 R2 for Itanium-based Systems (VBScript 5.8)

Refer to Microsoft Security Bulletin MS11-009 for further details.

Workarounds:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.


Microsoft Windows Client/Server Run-time Subsystem Elevation of Privilege Vulnerability (MS11-010)
SEVERITY: Critical Critical-4 4
QUALYS ID: 118955
VENDOR REFERENCE: MS11-010
CVE REFERENCE: CVE-2011-0030
CVSS SCORES: Base 6.9/ Temporal 5.1
THREAT: Microsoft has released a security update to resolve a vulnerability in Microsoft Windows Client/Server Run-time Subsystem in Microsoft Windows Windows XP and Windows Server 2003.

An elevation of privilege vulnerability exists because the Windows Client/Server Run-time Subsystem does not properly terminate user processes when a user logs out.

The security update is rated Important for all supported editions of Microsoft Windows XP and Windows Server 2003.

IMPACT: An attacker must have valid login credentials and be able to log on locally to exploit this vulnerability. This vulnerability can not be exploited by anonymous users. The vulnerability could allow elevation of privilege if an attacker logs on to the system and starts a specially crafted application designed to continue running after the attacker logs out.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS11-010 for further details.


Microsoft Windows Kernel Elevation of Privilege Vulnerabilities (MS11-011)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90659
VENDOR REFERENCE: MS11-011
CVE REFERENCE: CVE-2010-4398 | CVE-2011-0045
CVSS SCORES: Base 0/ Temporal 0
THREAT: Microsoft Windows is prone to a local privilege escalation vulnerability.

This issue affects the 'RtlQueryRegistryValues()' API function. Specifically, the size of the output value may be returned as either UNICODE_STRING or ULONG size, while the actual returned buffer size is determined by registry key type. Local attackers may trigger a stack-based buffer overflow to bypass User Access Control (UAC) protection mechanisms.

An elevation of privilege vulnerability exists due to the way that the Windows kernel allocates memory when reading user-supplied data. (CVE-2011-0045)

Microsoft has released a security update that addresses the vulnerabilities by ensuring that the Windows kernel properly validates user-supplied data before allocating memory.

This security update is rated Important for all supported versions of Microsoft Windows.

IMPACT: Successfully exploiting this vulnerability might allow an attacker to gain escalated privileges, create back doors or cause denial of service.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS11-011 for further details.


Microsoft Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (MS11-012)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90682
VENDOR REFERENCE: MS11-012
CVE REFERENCE: CVE-2011-0086 | CVE-2011-0087 | CVE-2011-0088 | CVE-2011-0089 | CVE-2011-0090
CVSS SCORES: Base 7.2/ Temporal 5.6
THREAT: The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.

The kernel is prone to the multiple vulnerabilities could allow elevation of privilege if an attacker logged on locally and ran a specially crafted application.

Microsoft has released a security update that addresses the vulnerabilities by correcting the way the Windows kernel-mode drivers validate input passed from user mode.

This security update is rated Important for all supported versions of Microsoft Windows.

IMPACT: An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 1 and Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS11-012 for further details.


Microsoft Kerberos Elevation of Privilege Vulnerability (MS11-013)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90686
VENDOR REFERENCE: MS11-013
CVE REFERENCE: CVE-2011-0043 | CVE-2011-0091
CVSS SCORES: Base 10/ Temporal 7.4
THREAT: Kerberos is a protocol used to mutually authenticate users and services on an open and unsecured network.

Kerberos is prone to elevation of privilege vulnerability, that is caused when the Microsoft Kerberos implementation in Microsoft Windows supports weak hashing mechanisms such as CRC32. (CVE-2011-0043)

Kerberos is prone to spoofing vulnerability, that is caused when Windows does not correctly enforce the stronger default encryption standards included in Windows 7 and Windows Server 2008 R2, making it possible for a man-in-the-middle attacker to force a downgrade in Kerberos communication between a client and server to a weaker encryption standard than negotiated originally. (CVE-2011-0091)

Microsoft has released an update that addresses the vulnerabilities by preventing the use of weak hashing algorithms in both Windows Kerberos and Windows KDC and by preventing the client from downgrading the encryption standard to DES for Kerberos communication between client and server.

This security update is rated Important for all supported editions of Windows XP, Windows Server 2003, Windows 7, and Windows Server 2008 R2.

IMPACT: An attacker that successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with these elevated rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows 7 for 32-bit Systems

Windows 7 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS11-013 for further details.


Microsoft Windows Local Security Authority Subsystem Service Local Elevation of Privilege Vulnerability (MS11-014)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90684
VENDOR REFERENCE: MS11-014
CVE REFERENCE: CVE-2011-0039
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: The Local Security Authority Subsystem Service (LSASS) provides an interface for managing local security, domain authentication, and Active Directory service processes.

An elevation of privilege vulnerability is caused when the Windows LSASS processes a specially crafted authentication request.

Microsoft has released a security update that addresses the vulnerability by correcting the manner in which LSASS handles specific values used in the authentication process.

The update is rated Important for for Windows XP and 2003.

IMPACT: An attacker who successfully exploited this vulnerability could gain complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS11-014 for further details.

This new vulnerability check is included in Qualys vulnerability signatures v1.28.13-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 100096
    • 90673
    • 90683
    • 90678
    • 118888
    • 90685
    • 110142
    • 90681
    • 118955
    • 90659
    • 90682
    • 90686
    • 90684
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/