October 11, 2011
Microsoft Security Bulletin: October 11
Advisory Overview

October 11, 2011 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 23 vulnerabilities present in Microsoft Windows that were announced today in 8 security bulletins. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription. Please visit our podcast page for patch tuesday prioritization and summary.

Vulnerability Details

Microsoft has released 8 security patches to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:


Microsoft Active Accessibility Remote Code Execution Vulnerability (MS11-075)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90743
VENDOR REFERENCE: MS11-075
CVE REFERENCE: CVE-2011-1247
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: The Microsoft Active Accessibility component is a Component Object Model-based technology that improves the way accessibility aids work with applications running on Microsoft Windows.

Microsoft Active Accessibility is prone to a vulnerability because the Microsoft Active Accessibility component improperly restricts the path used for loading external libraries.

Microsoft has released a security update that addresses this vulnerability by correcting the manner in which the Microsoft Active Accessibility component loads external libraries.

This security update is rated Important for all supported releases of Microsoft Windows.

IMPACT: Exploitation could allow an attacker to execute arbitrary code.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Refer to Microsoft Security Bulletin MS11-075 for further details.


Microsoft Windows Media Center Remote Code Execution Vulnerability (MS11-076)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90747
VENDOR REFERENCE: MS11-076
CVE REFERENCE: CVE-2011-2009
CVSS SCORES: Base 9.3 | Temporal 7.3
THREAT: This security update resolves a publicly disclosed vulnerability in Windows Media Center. The security update addresses the vulnerability by correcting the manner in which Windows Media Center loads external libraries.

This security update is rated Important for all supported editions of Windows Vista and Windows 7; and Windows Media Center TV Pack for Windows Vista.

IMPACT: The vulnerability could allow remote code execution if an attacker convinces a user to open a legitimate file that is located in the same network directory as a specially crafted dynamic link library (DLL) file. Then, while opening the legitimate file, Windows Media Center could attempt to load the DLL file and execute any code it contained.

For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a legitimate file.

SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Windows Media Center TV Pack for Windows Vista (32-bit editions)

Windows Media Center TV Pack for Windows Vista (64-bit editions)

Refer to Microsoft Security Bulletin MS11-076 for further details.


Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS11-077)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90746
VENDOR REFERENCE: MS11-077
CVE REFERENCE: CVE-2011-1985 | CVE-2011-1985 | CVE-2011-2002 | CVE-2011-2003
CVSS SCORES: Base 7.2 | Temporal 5.6
THREAT: This security update resolves four privately reported vulnerabilities in Microsoft Windows.

The security update addresses the vulnerabilities by correcting the way that the Windows kernel-mode drivers validate input passed from user mode, handle the TrueType font type, allocate the proper buffer size before writing to memory, and manage kernel-mode driver objects.

This security update is rated Important for all supported releases of Microsoft Windows.

IMPACT: The most severe of these vulnerabilities could allow remote code execution if a user opens a specially crafted font file (such as a .fon file) in a network share, a UNC or WebDAV location, or an e-mail attachment. For a remote attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open the specially crafted font file, or open the file as an e-mail attachment.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Refer to Microsoft Security Bulletin MS11-077 for further details.


Microsoft .NET Framework and Silverlight Remote Code Execution Vulnerability (MS11-078)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90745
VENDOR REFERENCE: MS11-078
CVE REFERENCE: CVE-2011-1253
CVSS SCORES: Base 9.3 | Temporal 6.2
THREAT: The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.

A remote code execution vulnerability exists in the way that the Microsoft .NET Framework and Silverlight framework restrict inheritance within classes.

This security update is rated Critical for Microsoft .NET Framework 1.0 Service Pack 3, Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Microsoft Windows; and Microsoft Silverlight 4.

IMPACT: Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Microsoft .NET Framework 1.0 Service Pack 3)

Windows XP Service Pack 3 (Microsoft .NET Framework 1.1 Service Pack 1)

Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)

Windows XP Service Pack 3 (Microsoft .NET Framework 4)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 1.1 Service Pack 1)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 2.0 Service Pack 2)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 4)

Windows Vista Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

Microsoft Silverlight 4

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-078.


Microsoft Forefront Unified Access Gateway Remote Code Execution Vulnerability (MS11-079)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90749
VENDOR REFERENCE: MS11-079
CVE REFERENCE: CVE-2011-1895 | CVE-2011-1896 | CVE-2011-1897 | CVE-2011-1969 | CVE-2011-2012
CVSS SCORES: Base 8.3 | Temporal 6.1
THREAT: Microsoft Forefront Unified Access Gateway (UAG) is a reverse proxy and VPN solution that provides secure remote access to corporate networks for remote employees and business partners.

An HTTP response splitting vulnerability exists in Microsoft Forefront Unified Access Gateway (UAG) server where JavaScript can be injected back to the user in the resulting page, effectively allowing attacker-controlled JavaScript to run in the context of the user clicking the link. (CVE-2011-1895)

An XSS vulnerability exists in Microsoft Forefront Unified Access Gateway (UAG) server where JavaScript can be injected back to the user in the resulting page, effectively allowing attacker-controlled JavaScript to run in the context of the user clicking the link. (CVE-2011-1896)

Microsoft Forefront Unified Access Gateway (UAG) applies a signed Java applet that can be leveraged by malicious Web sites to cause remote code execution on any Java-enabled Web browser. (CVE-2011-1969)

A denial of service vulnerability exists in implementations of Microsoft Forefront Unified Access Gateway (UAG). When this occurs, an attacker could leverage the vulnerability to stop the IIS worker process and deny access to Web services on the affected system. (CVE-2011-2012)

Affected Software:
Microsoft Forefront Unified Access Gateway 2010
Microsoft Forefront Unified Access Gateway 2010 Update 1
Microsoft Forefront Unified Access Gateway 2010 Update 2
Microsoft Forefront Unified Access Gateway 2010 Service Pack 1

IMPACT: An attacker who successfully exploits this vulnerability could read content that the attacker is not authorized to read, use the victim's identity to take actions on behalf of the victim, and inject malicious content in the browser of the victim and crash the web server on the affected UAG machine.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Forefront Unified Access Gateway 2010

Microsoft Forefront Unified Access Gateway 2010 Update 1

Microsoft Forefront Unified Access Gateway 2010 Update 2

Microsoft Forefront Unified Access Gateway 2010 Service Pack 1

Refer to Microsoft Security Bulletin MS11-079 for further details.


Microsoft Ancillary Function Driver Elevation of Privileges Vulnerability (MS11-080)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90744
VENDOR REFERENCE: MS11-080
CVE REFERENCE: CVE-2011-2005
CVSS SCORES: Base 6.8 | Temporal 5
THREAT: The Ancillary Function Driver (AFD) supports Windows sockets applications and is contained in the afd.sys file.

An elevation of privilege vulnerability exists where the Ancillary Function Driver (afd.sys) improperly validates input passed from user mode to the kernel.

Microsoft has released a security update that addresses the vulnerability by correcting the way that AFD validates input before passing the input from user mode to the Windows kernel.

This security update is rated Important.

IMPACT: If this vulnerability is successfully exploited, a local attacker can execute arbitrary code and take complete control of an affected system.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS11-080 for further details.


Microsoft Internet Explorer Cumulative Security Update (MS11-081)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 100111
VENDOR REFERENCE: MS11-081
CVE REFERENCE: CVE-2011-1993 | CVE-2011-1995 | CVE-2011-1996 | CVE-2011-1997 | CVE-2011-1998 | CVE-2011-1999 | CVE-2011-2000 | CVE-2011-2001
CVSS SCORES: Base 10 | Temporal 7.4
THREAT: Microsoft Internet Explorer is a Web browser available for Microsoft Windows.

When Internet Explorer attempts to access an object that has been deleted or a dereferenced memory address or a corrupted virtual function table, it may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user.

Microsoft has released an update that addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory and the way that Internet Explorer allocates and accesses memory.

This security update is rated Critical for Internet Explorer on Windows clients and Moderate for Internet Explorer on Windows servers.

IMPACT: The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploits any of these vulnerabilities could gain the same user rights as the local user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Internet Explorer 6)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 Service Pack 2 (Internet Explorer 6)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

Windows XP Service Pack 3 (Internet Explorer 7)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 Service Pack 2 (Internet Explorer 7)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

Windows Vista Service Pack 2 (Internet Explorer 7)

Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)

Windows XP Service Pack 3 (Internet Explorer 8)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-081.


Microsoft Host Integration Server Denial of Service Vulnerability (MS11-082)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90748
VENDOR REFERENCE: MS11-082
CVE REFERENCE: CVE-2011-2008 | CVE-2011-2007
CVSS SCORES: Base 7.8 | Temporal 6.4
THREAT: Microsoft Host Integration Server (HIS) is a gateway application providing connectivity between Microsoft Windows Networks and IBM mainframe and AS/400 systems.

Microsoft Host Integration Server is prone to a denial of service vulnerability that is caused due to improper input validation when Host Integration Server processes specially crafted network traffic. (CVE-2011-2008,CVE-2011-2007)

Affected Software:
Microsoft Host Integration Server 2004 Service Pack 1
Microsoft Host Integration Server 2006 Service Pack 1
Microsoft Host Integration Server 2009
Microsoft Host Integration Server 2010

IMPACT: A remote, anonymous attacker who exploits this vulnerability could cause the affected SNA Server service and all dependent services to stop responding.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Host Integration Server 2004 Service Pack 1

Microsoft Host Integration Server 2006 Service Pack 1

Microsoft Host Integration Server 2009

Microsoft Host Integration Server 2010

Refer to Microsoft Security Bulletin MS11-082 for further details.

This new vulnerability check is included in Qualys vulnerability signatures 1.28.241-4. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 90743
    • 90747
    • 90746
    • 90745
    • 90749
    • 90744
    • 100111
    • 90748
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/