March 13, 2012
Microsoft Security Bulletin: March 13
Advisory Overview

March 13, 2012 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 9 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.

Vulnerability Details

Microsoft has released 6 security patches to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:


Microsoft Visual Studio Privilege Escalation Vulnerability (MS12-021)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90787
VENDOR REFERENCE: MS12-021
CVE REFERENCE: CVE-2012-0008
CVSS SCORES: Base 8.5 | Temporal 6.3
THREAT: Visual Studio add-ins implement an extensibility interface within Visual Studio for customizing and automating the interactive development environmen.

An elevation of privilege vulnerability exists in Visual Studio. This vulnerability is caused by Visual Studio loading add-ins from insecure file locations.

Microsoft has released a security update that addresses the vulnerability by correcting the manner in which Visual Studio restricts where add-ins are loaded.

This security update is rated Important for all supported editions of Microsoft Visual Studio 2008 and Microsoft Visual Studio 2010.

IMPACT: The vulnerability could allow elevation of privilege if an attacker places a specially crafted add-in in the path used by Visual Studio and convinces a user with higher privileges to start Visual Studio. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Visual Studio 2008 Service Pack 1

Microsoft Visual Studio 2010

Microsoft Visual Studio 2010 Service Pack 1

Refer to Microsoft Security Bulletin MS12-021 for further details.


Microsoft Windows DirectWrite Could Allow Denial of Service Vulnerability (MS12-019)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90786
VENDOR REFERENCE: MS12-019
CVE REFERENCE: CVE-2012-0156
CVSS SCORES: Base 9.3 | Temporal 7.3
THREAT: DirectWrite is a full Unicode, resolution-independent, multi-format text rendering API that supports measuring, drawing and hit-testing of text.

This security update addresses the vulnerability by changing the way that DirectWrite renders Unicode characters.

Affected Software:
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

This security update is rates as Moderate.

IMPACT: In an Instant Messenger-based attack, this vulnerability could allow denial of service if an attacker sends a specially crafted sequence of Unicode characters directly to an Instant Messenger client. The target application could become unresponsive when DirectWrite renders the specially crafted sequence of Unicode characters.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Refer to Microsoft Security Bulletin MS12-019 for further details.


Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS12-018)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90785
VENDOR REFERENCE: MS12-018
CVE REFERENCE: CVE-2012-0157
CVSS SCORES: Base 9.3 | Temporal 7.3
THREAT: The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.

The security update addresses the vulnerability by correcting the way the Windows kernel-mode driver handles window messaging.

Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

This security update is rated Critical.

IMPACT: This vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Refer to Microsoft Security Bulletin MS12-018 for further details.


Microsoft Expression Design Remote Code Execution Vulnerability (MS12-022)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90784
VENDOR REFERENCE: MS12-022
CVE REFERENCE: CVE-2012-0016
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: Microsoft Expression Design is a professional illustration vector and raster graphic design tool for web images.

A remote code execution vulnerability exists in the way Microsoft Expression Design handles the loading of DLL files. The vulnerability occurs when Microsoft Expression Design incorrectly restricts the path used for loading external libraries. (CVE-2012-0016)

Affected Software:
Microsoft Expression Design
Microsoft Expression Design Service Pack 1
Microsoft Expression Design 2
Microsoft Expression Design 3
Microsoft Expression Design 4

This security update is rated Important.

IMPACT: An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Expression Design

Microsoft Expression Design Service Pack 1

Microsoft Expression Design 2

Microsoft Expression Design 3

Microsoft Expression Design 4

Refer to Microsoft Security Bulletin MS12-022 for further details.


Microsoft Windows Remote Desktop Protocol Remote Code Execution Vulnerability (MS12-020)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90783
VENDOR REFERENCE: MS12-020
CVE REFERENCE: CVE-2012-0002 | CVE-2012-0152
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: The Remote Desktop feature in Windows enables access to all of the programs, resources and accessories on a user's computer from a second Windows-based computer.

A remote code execution vulnerability exists in the way the Remote Desktop Protocol accesses an object in memory that has been improperly initialized or has been deleted (CVE-2012-0002).

A denial of service vulnerability exists in the way the Remote Desktop Protocol service processes packets. An attacker who successfully exploited this vulnerability could cause the target service to stop responding (CVE-2012-0152).

This security update is rated Critical for all supported releases of Microsoft Windows.

IMPACT: Successfully exploiting these vulnerabilities might allow a remote attacker to execute arbitrary code or cause a denial of service.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1*

Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Refer to Microsoft Security Bulletin MS12-020 for further details.


Microsoft Windows DNS Server Denial of Service Vulnerability (MS12-017)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90782
VENDOR REFERENCE: MS12-017
CVE REFERENCE: CVE-2012-0006
CVSS SCORES: Base 7.1 | Temporal 5.3
THREAT: Microsoft Windows DNS server is vulnerable to a denial of service issue due to improper handling of objects in memory when looking up the resource record of a domain.

This security update is rated Important for 32-bit and x64-based editions of Windows Server 2008, and x64-based editions of Windows Server 2008 R2; and all supported editions of Windows Server 2003.

IMPACT: An attacker that successfully exploits this vulnerability could cause the DNS system to stop responding and restart.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Workaround:
Disable the DNS service if you are not using it.

This new vulnerability check is included in Qualys vulnerability signatures 2.2.72-4. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 90787
    • 90786
    • 90785
    • 90784
    • 90783
    • 90782
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/