March 13, 2012 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 9 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.
Microsoft has released 6 security patches to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:
| Microsoft Visual Studio Privilege Escalation Vulnerability (MS12-021) |
|---|
SEVERITY: Critical  4 |
| QUALYS ID: 90787 |
| VENDOR REFERENCE: MS12-021 |
| CVE REFERENCE: CVE-2012-0008 |
| CVSS SCORES: Base 8.5 | Temporal 6.3 |
| THREAT: Visual Studio add-ins implement an extensibility interface within Visual Studio for customizing and automating the interactive development environmen.
An elevation of privilege vulnerability exists in Visual Studio. This vulnerability is caused by Visual Studio loading add-ins from insecure file locations. Microsoft has released a security update that addresses the vulnerability by correcting the manner in which Visual Studio restricts where add-ins are loaded. This security update is rated Important for all supported editions of Microsoft Visual Studio 2008 and Microsoft Visual Studio 2010. |
| IMPACT: The vulnerability could allow elevation of privilege if an attacker places a specially crafted add-in in the path used by Visual Studio and convinces a user with higher privileges to start Visual Studio. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Visual Studio 2008 Service Pack 1 Microsoft Visual Studio 2010 Service Pack 1 Refer to Microsoft Security Bulletin MS12-021 for further details. |
| Microsoft Windows DirectWrite Could Allow Denial of Service Vulnerability (MS12-019) |
|---|
SEVERITY: Serious  3 |
| QUALYS ID: 90786 |
| VENDOR REFERENCE: MS12-019 |
| CVE REFERENCE: CVE-2012-0156 |
| CVSS SCORES: Base 9.3 | Temporal 7.3 |
| THREAT: DirectWrite is a full Unicode, resolution-independent, multi-format text rendering API that supports measuring, drawing and hit-testing of text.
This security update addresses the vulnerability by changing the way that DirectWrite renders Unicode characters. Affected Software: This security update is rates as Moderate. |
| IMPACT: In an Instant Messenger-based attack, this vulnerability could allow denial of service if an attacker sends a specially crafted sequence of Unicode characters directly to an Instant Messenger client. The target application could become unresponsive when DirectWrite renders the specially crafted sequence of Unicode characters. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Refer to Microsoft Security Bulletin MS12-019 for further details. |
| Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS12-018) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90785 |
| VENDOR REFERENCE: MS12-018 |
| CVE REFERENCE: CVE-2012-0157 |
| CVSS SCORES: Base 9.3 | Temporal 7.3 |
| THREAT: The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.
The security update addresses the vulnerability by correcting the way the Windows kernel-mode driver handles window messaging. Affected Software: This security update is rated Critical. |
| IMPACT: This vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-based Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Refer to Microsoft Security Bulletin MS12-018 for further details. |
| Microsoft Expression Design Remote Code Execution Vulnerability (MS12-022) |
|---|
| SEVERITY: Critical 4 |
| QUALYS ID: 90784 |
| VENDOR REFERENCE: MS12-022 |
| CVE REFERENCE: CVE-2012-0016 |
| CVSS SCORES: Base 9.3 | Temporal 6.9 |
| THREAT: Microsoft Expression Design is a professional illustration vector and raster graphic design tool for web images.
A remote code execution vulnerability exists in the way Microsoft Expression Design handles the loading of DLL files. The vulnerability occurs when Microsoft Expression Design incorrectly restricts the path used for loading external libraries. (CVE-2012-0016) Affected Software: This security update is rated Important. |
| IMPACT: An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Microsoft Expression Design Service Pack 1 Refer to Microsoft Security Bulletin MS12-022 for further details. |
| Microsoft Windows Remote Desktop Protocol Remote Code Execution Vulnerability (MS12-020) |
|---|
SEVERITY: Urgent  5 |
| QUALYS ID: 90783 |
| VENDOR REFERENCE: MS12-020 |
| CVE REFERENCE: CVE-2012-0002 | CVE-2012-0152 |
| CVSS SCORES: Base 9.3 | Temporal 6.9 |
| THREAT: The Remote Desktop feature in Windows enables access to all of the programs, resources and accessories on a user's computer from a second Windows-based computer.
A remote code execution vulnerability exists in the way the Remote Desktop Protocol accesses an object in memory that has been improperly initialized or has been deleted (CVE-2012-0002). A denial of service vulnerability exists in the way the Remote Desktop Protocol service processes packets. An attacker who successfully exploited this vulnerability could cause the target service to stop responding (CVE-2012-0152). This security update is rated Critical for all supported releases of Microsoft Windows. |
| IMPACT: Successfully exploiting these vulnerabilities might allow a remote attacker to execute arbitrary code or cause a denial of service. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows XP Professional x64 Edition Service Pack 2 Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2003 with SP2 for Itanium-based Systems Windows Vista x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-based Systems Service Pack 2 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 Refer to Microsoft Security Bulletin MS12-020 for further details. |
| Microsoft Windows DNS Server Denial of Service Vulnerability (MS12-017) |
|---|
| SEVERITY: Serious 3 |
| QUALYS ID: 90782 |
| VENDOR REFERENCE: MS12-017 |
| CVE REFERENCE: CVE-2012-0006 |
| CVSS SCORES: Base 7.1 | Temporal 5.3 |
| THREAT: Microsoft Windows DNS server is vulnerable to a denial of service issue due to improper handling of objects in memory when looking up the resource record of a domain.
This security update is rated Important for 32-bit and x64-based editions of Windows Server 2008, and x64-based editions of Windows Server 2008 R2; and all supported editions of Windows Server 2003. |
| IMPACT: An attacker that successfully exploits this vulnerability could cause the DNS system to stop responding and restart. |
| SOLUTION: Patch: Following are links for downloading patches to fix the vulnerabilities: Windows Server 2003 Service Pack 2 Windows Server 2003 x64 Edition Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Workaround: |
This new vulnerability check is included in Qualys vulnerability signatures 2.2.72-4. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.
SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90787
- 90786
- 90785
- 90784
- 90783
- 90782
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
Access for QualysGuard customers: https://qualysguard.qualys.com
Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/
