December 13, 2011 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 12 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.
Microsoft has released 12 security patches to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:
| Microsoft Kernel-Mode Drivers Remote Code Execution Vulnerability (MS11-087 and KB2639658) |
|---|
SEVERITY: Urgent  5 |
| QUALYS ID: 119717 |
| VENDOR REFERENCE: 2639658 |
| CVE REFERENCE: CVE-2011-3402 |
| CVSS SCORES: Base 9.3 | Temporal 7.7 |
| THREAT: Win32k.sys is a kernel-mode device driver and exists in the kernel of the Windows subsystem. It contains the window manager, which controls window displays; manages screen output; collects input from the keyboard, mouse, and other devices; and passes user messages to applications. It also contains the Graphics Device Interface (GDI), which is a library of functions for graphics output devices. Finally, it serves as a wrapper for DirectX support that is implemented in another driver (dxgkrnl.sys).
Microsoft Windows kernel is prone to a remote code execution vulnerability when a Windows kernel-mode driver fails to properly handle the TrueType font type. This vulnerability is reported to be included in the Duqu Trojan and has been used in targeted attacks.
Affected Software: |
| IMPACT: If this vulnerability is successfully exploited, attackers can execute arbitrary code with kernel-level privileges. Failed exploit attempts may result in a denial of service. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-based Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Refer to Microsoft Security Bulletin MS11-087 for further details.
Workaround:
Impact of Workaround: |
| Microsoft Office Remote Code Execution Vulnerability (MS11-089) |
|---|
SEVERITY: Critical  4 |
| QUALYS ID: 110168 |
| VENDOR REFERENCE: MS11-089 |
| CVE REFERENCE: CVE-2011-1983 |
| CVSS SCORES: Base 9.3 | Temporal 6.9 |
| THREAT: Microsoft Word is a proprietary word processing application written and distributed by Microsoft.
A remote code execution vulnerability exists in the way that Microsoft Word handles specially crafted Word files. Microsoft has released a security update that addresses the vulnerability by correcting the way that Microsoft Word parses specially crafted Word files.
Affected Software: This security update is rated Important. |
| IMPACT: The vulnerability could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploits this vulnerability could gain the same user rights as the logged-on user. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Office 2007 Service Pack 2 and Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions) Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions) Refer to Microsoft Security Bulletin MS11-089.
Workaround: |
| Microsoft Cumulative Security Update of ActiveX Kill Bits (MS11-090) |
|---|
| SEVERITY: Urgent 5 |
| QUALYS ID: 90761 |
| VENDOR REFERENCE: MS11-090 |
| CVE REFERENCE: CVE-2011-3397 |
| CVSS SCORES: Base 9.3 | Temporal 6.9 |
| THREAT: A remote code execution vulnerability exists in the Microsoft Time component. When the binary behavior is used in Internet Explorer, the behavior may corrupt the system state in such a way that an attacker could execute arbitrary code. (CVE-2011-3397)
Affected Software: This security update is rated Critical. |
| IMPACT: An attacker who successfully exploits this vulnerability could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-based Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Please refer to Microsoft Security Bulletin MS11-090 for further details. |
| Microsoft Office Publisher Remote Code Execution Vulnerability (MS11-091) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 110161 |
| VENDOR REFERENCE: MS11-091 |
| CVE REFERENCE: CVE-2011-1508 | CVE-2011-3410 | CVE-2011-3411 | CVE-2011-3412 |
| CVSS SCORES: Base 10 | Temporal 7.4 |
| THREAT: Microsoft Office Publisher is a desktop publishing application.
Multiple vulnerabilities exists in the file parsing code when Microsoft Office Publisher opens a malicious file.
Affected Software:
This security update is rated Important. |
| IMPACT: An attacker can exploit this issue by persuading an unsuspecting user into opening a malicious file. This vulnerability allows attackers to execute arbitrary code on the user's system. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Office 2003 Service Pack 3 (Microsoft Publisher 2003 Service Pack 3) Microsoft Office 2007 Service Pack 2 (Microsoft Publisher 2007 Service Pack 2) Microsoft Office 2007 Service Pack 3 (Microsoft Publisher 2007 Service Pack 3) Refer to Microsoft Security Bulletin MS11-091 for further details. |
| Microsoft Windows Media Player Remote Code Execution Vulnerability (MS11-092) |
|---|
| SEVERITY: Urgent 5 |
| QUALYS ID: 119547 |
| VENDOR REFERENCE: MS11-092 |
| CVE REFERENCE: CVE-2011-3401 |
| CVSS SCORES: Base 9.3 | Temporal 6.9 |
| THREAT: Windows Media Player is a video and audio file player for Windows-based systems. It supports multiple file formats and allows playing files from either the local file system or the network.
A vulnerability exists in the Windows Media Player XDS Codec filter during the processing of a specially crafted DVR-MS file. If a large length value is supplied within a certain chunk of a DVR-MS file, a heap allocation for the chunk data can fail and the return value of the allocation routine will not be checked for an error. Microsoft has released a security update that addresses the vulnerability by modifying the way that Windows Media Player and Windows Media Center open specially crafted .dvr-ms files.
Affected Software: This security update is rated Critical. Note: Previously this was an iDefense vulnerability with ID: 647554 |
| IMPACT: If this vulnerability is successfully exploited, attackers can execute arbitrary code. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Media Center Edition 2005 Service Pack 3 Windows XP Professional x64 Edition Service Pack 2 Windows Vista x64 Edition Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Refer to Microsoft Security Bulletin MS11-092.
Workaround: It is possible to use Windows ACLs to block access to the vulnerable library. To prevent this library from loading, use the calcs program included with Windows: cacls "%windir%\system32\encdec.dll" /E /P everyone:N This will prevent Windows Media Player from loading this library. To undo this workaround, use the following command: cacls "%windir%\system32\encdec.dll" /E /Reveryone |
| Microsoft Windows OLE Remote Code Execution Vulnerability (MS11-093) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90759 |
| VENDOR REFERENCE: MS11-093 |
| CVE REFERENCE: CVE-2011-3400 |
| CVSS SCORES: Base 7.5 | Temporal 5.9 |
| THREAT: A vulnerability exists in OLE that could lead to remote code execution if a user opens a file that contains a specially crafted OLE object. This security update addresses the vulnerability by modifying the way that OLE objects are handled in memory.
Affected Software: This security update is rated Important. |
| IMPACT: This vulnerability could allow remote code execution if a user opens a file that contains a specially crafted OLE object. An attacker who successfully exploits this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix this vulnerability: Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Refer to Microsoft Security Bulletin MS11-093 for further details. |
| Microsoft PowerPoint Remote Code Execution Vulnerability (MS11-094) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 110169 |
| VENDOR REFERENCE: MS11-094 |
| CVE REFERENCE: CVE-2011-3413 | CVE-2011-3396 |
| CVSS SCORES: Base 9.3 | Temporal 7.3 |
| THREAT: A remote code execution vulnerability exists in the way that Microsoft PowerPoint handles the loading of DLL files and specially crafted PowerPoint files. The security update addresses the vulnerabilities by correcting the way that PowerPoint loads external libraries and modifying the way that it validates OfficeArt records when opening PowerPoint files.
Affected Software: This security update is rated Important. |
| IMPACT: An attacker who successfully exploits either of the vulnerabilities could take complete control of an affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Office 2007 Service Pack 2 (Microsoft PowerPoint 2007 Service Pack 2) Microsoft Office 2010 (32-bit editions) (Microsoft PowerPoint 2010 (32-bit editions)) Microsoft Office 2010 (64-bit editions) (Microsoft PowerPoint 2010 (64-bit editions)) Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2 Microsoft PowerPoint Viewer 2007 Service Pack 2 Microsoft Office 2007 Service Pack 2 (Microsoft PowerPoint 2007 Service Pack 2) Microsoft Office 2010 (32-bit editions) (Microsoft PowerPoint 2010 (32-bit editions)) Microsoft Office 2010 (64-bit editions) (Microsoft PowerPoint 2010 (64-bit editions)) Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2 Microsoft PowerPoint Viewer 2007 Service Pack 2 Refer to Microsoft Security Bulletin MS11-094 for further details. |
| Microsoft Active Directory Remote Code Execution Vulnerability (MS11-095) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90762 |
| VENDOR REFERENCE: MS11-095 |
| CVE REFERENCE: CVE-2011-3406 |
| CVSS SCORES: Base 8.5 | Temporal 6.3 |
| THREAT: Active Directory Services contains an extensible and scalable set of services that enables you to efficiently manage corporate identities, credentials, information protection, and system and application settings.
A remote code execution vulnerability exists in Active Directory. To exploit this vulnerability, an attacker would first need to acquire credentials to log on to an Active Directory domain. An attacker could then run a specially crafted application that could exploit the vulnerability and take complete control over the affected system.
Affected Software: This security update is rated Important. |
| IMPACT: Successfully exploiting this vulnerability might allow a remote authenticated user to execute arbitrary code. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Service Pack 3 (Active Directory Application Mode (ADAM)) Windows XP Professional x64 Edition Service Pack 2 (Active Directory Application Mode (ADAM)) Windows Server 2003 Service Pack 2 (Active Directory) Windows Server 2003 Service Pack 2 (Active Directory Application Mode ) Windows Server 2003 x64 Edition Service Pack 2 (Active Directory) Windows Server 2003 x64 Edition Service Pack 2 (Active Directory Application Mode ) Windows Server 2003 with SP2 for Itanium-based Systems (Active Directory) Windows Vista Service Pack 2 (Active Directory Lightweight Directory Service (AD LDS)) Windows Vista x64 Edition Service Pack 2 (Active Directory Lightweight Directory Service (AD LDS)) Please refer to Microsoft Security Bulletin MS11-095 for further details. |
| Microsoft Excel Remote Code Execution Vulnerabilities (MS11-096) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 110170 |
| VENDOR REFERENCE: MS11-096 |
| CVE REFERENCE: CVE-2011-1986 |
| CVSS SCORES: Base 7.5 | Temporal 5.5 |
| THREAT: Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft for Windows and Mac OS X.
Microsoft Excel is vulnerable to a remote code execution vulnerability due to incorrectly handling objects in memory.
Affected Software: This security update is rated Important. |
| IMPACT: An attacker can exploit this issue by persuading an unsuspecting user into opening a malicious file. This vulnerability allows attackers to execute arbitrary code on the user's system. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3) Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3) Refer to Microsoft Security Bulletin MS11-096 for further details. |
| Microsoft Windows Client/Server Run-time Subsystem Elevation of Privilege Vulnerability (MS11-097) |
|---|
SEVERITY: Serious  3 |
| QUALYS ID: 90760 |
| VENDOR REFERENCE: MS11-097 |
| CVE REFERENCE: CVE-2011-3408 |
| CVSS SCORES: Base 6.8 | Temporal 5 |
| THREAT: The Client/Server Run-time Subsystem (CSRSS) is the user-mode portion of the Win32 subsystem. CSRSS is an essential subsystem that must be running at all times. CSRSS is responsible for console windows, and creating and/or deleting threads.
An elevation of privilege vulnerability exists in the Client/Server Run-time Subsystem (CSRSS), allowing arbitrary code to be executed in the context of another process. This security update is rated Important for all supported releases of Microsoft Windows. |
| IMPACT: Successfully exploiting this vulnerability might allow a locally authenticated attacker to gain escalated privileges. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-based Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Please refer to Microsoft Security Bulletin MS11-097 for further details. |
| Microsoft Windows Kernel Privilege escalation Vulnerability (MS11-098) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90758 |
| VENDOR REFERENCE: MS11-098 |
| CVE REFERENCE: CVE-2011-2018 |
| CVSS SCORES: Base 6.4 | Temporal 5 |
| THREAT: An elevation of privilege vulnerability exists in the Windows kernel due to the way the kernel accesses an object that has not been correctly initialized. The security update addresses the vulnerability by helping to ensure that the Windows kernel initializes objects in memory.
Affected Software: This security update is rated Important. |
| IMPACT: The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application designed to exploit the vulnerability. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users. |
| SOLUTION: Patch: Following are links for downloading patches to fix this vulnerability: Windows Server 2003 Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows Server 2003 Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Refer to Microsoft Security Bulletin MS11-098 for further details. |
| Microsoft Cumulative Security Update for Internet Explorer (MS11-099) |
|---|
| SEVERITY: Urgent 5 |
| QUALYS ID: 100114 |
| VENDOR REFERENCE: MS11-099 |
| CVE REFERENCE: CVE-2011-1992 | CVE-2011-2019 | CVE-2011-3404 |
| CVSS SCORES: Base 9.3 | Temporal 6.9 |
| THREAT: Microsoft Internet Explorer is a Web browser for Microsoft Windows.
An information disclosure vulnerability exists in Internet Explorer. That is cauesed due to the Internet Explore XSS Filter incorrectly allows attackers to read content from different domains through trial and error attacks. (CVE-2011-1992) A remote code execution vulnerability exists in the way that Internet Explorer handles the loading of DLL files. Internet Explorer does not properly restrict the path used for loading external libraries. (CVE-2011-2019) An information disclosure vulnerability exists in Internet Explorer, that is caused when, during certain processes, Internet Explorer incorrectly renders Web pages. (CVE-2011-3404)
Affected Software: This security update is rated Important. |
| IMPACT: An attacker who successfully exploited this vulnerability could run arbitrary code as the logged-on user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged-on with administrative user rights, an attacker could take complete control of the affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Service Pack 3 (Internet Explorer 6) Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6) Windows Server 2003 Service Pack 2 (Internet Explorer 6) Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6) Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6) Windows XP Service Pack 3 (Internet Explorer 7) Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7) Windows Server 2003 Service Pack 2 (Internet Explorer 7) Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7) Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7) Windows Vista Service Pack 2 (Internet Explorer 7) Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7) Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7) Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7) Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7) Please refer to Microsoft Security Bulletin MS11-099 for further details. |
This new vulnerability check is included in Qualys vulnerability signatures 1.28.299-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.
SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 119717
- 110167
- 110168
- 90761
- 110161
- 119547
- 90759
- 110169
- 90762
- 110170
- 90760
- 90758
- 100114
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
Access for QualysGuard customers: https://qualysguard.qualys.com
Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/
