September 11, 2012
Microsoft Security Bulletin: September 11
Advisory Overview

September 11, 2012 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 2 vulnerabilities present in Microsoft Windows that were announced today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription. Please visit our podcast page for patch tuesday prioritization and summary.

Vulnerability Details

Microsoft has released 2 security patches to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:


Visual Studio Team Foundation Server Elevation of Privilege Vulnerability (MS12-061)
SEVERITY: Critical Critical-4 4
QUALYS ID: 120498
VENDOR REFERENCE: MS12-061
CVE REFERENCE: CVE-2012-1892
CVSS SCORES: Base 6.4 | Temporal 4.7
THREAT: Microsoft Visual Studio Team Foundation Server is a version-control and bug-tracking system for developers using Visual Studio 2010.

A reflected XSS vulnerability exists in Visual Studio Team Foundation Server.

Microsoft has released a security update that addresses the vulnerabilities by correcting how the Team Foundation Server site validates input parameters.

This security update is rated Important for all supported editions of Microsoft Visual Studio Team Foundation Server 2010.

IMPACT: If this vulnerability is successfully exploited, attackers can inject a client-side script into the user's instance of Internet Explorer. The script could spoof content, disclose information, or take any action that the user could take on the site on behalf of the targeted user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Visual Studio Team Foundation Server 2010 Service Pack 1

Refer to Microsoft Security Bulletin MS12-061 for further details.

Workaround:
Enable Internet Explorer 8 and Internet Explorer 9 XSS filter in the Local intranet security zone.


Microsoft System Center Configuration Manager Elevation of Privilege Vulnerability (MS12-062)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90832
VENDOR REFERENCE: MS12-062
CVE REFERENCE: CVE-2012-2536
CVSS SCORES: Base 6.8 | Temporal 5.6
THREAT: Systems Management Server is a systems management software product by Microsoft for managing large groups of Windows-based computer systems. It provides remote control, patch management, software distribution, operating system deployment, network access protection, and hardware and software inventory.

A cross-site scripting vulnerability exists in System Center Configuration Manager where code can be injected back to the user in the resulting page, effectively allowing attacker-controlled code to run in the context of the user clicking the link. This vulnerability is caused when System Center Configuration Manager improperly handles specially crafted requests that allow an attacker to gain access to System Center Configuration Manager and carry out the same actions as an authenticated user. (CVE-2012-2536)

Affected Software:
Microsoft Systems Management Server 2003 Service Pack 3
Microsoft System Center Configuration Manager 2007 Service Pack 2

IMPACT: An attacker who successfully exploited this vulnerability could inject a client-side script in the user's browser. The script could spoof content, disclose information, or take any action that the user could take on the affected website on behalf of the targeted user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Systems Management Server 2003 Service Pack 3

Microsoft System Center Configuration Manager 2007 Service Pack 2

Workaround:
- Enable Internet Explorer 8 and Internet Explorer 9 XSS filter in the Local intranet security zone.

- You can help protect against exploitation of this vulnerability by changing your settings to enable the XSS filter in the Local intranet security zone. (XSS filter is enabled by default in the Internet security zone.) To do this, perform the following steps:
- In Internet Explorer 8 or Internet Explorer 9, click Internet Options on the Tools menu.
- Click the Security tab.
- Click Local intranet, and then click Custom level.
- Under Settings, in the Scripting section, under Enable XSS filter, click Enable, and then click OK.
- Click OK two times to return to Internet Explorer.

- Impact of workaround: Internal sites not previously flagged as being XSS risks could be flagged.

This new vulnerability check is included in Qualys vulnerability signatures 2.2.220-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 120498
    • 90832
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/