October 09, 2012
Microsoft Security Bulletin: October 9
Advisory Overview

October 9, 2012 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 20 vulnerabilities that were fixed in 7 bulletin(s) announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription. Please visit our podcast page for patch tuesday prioritization and summary.

Vulnerability Details

Microsoft has released 7 security bulletins to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:


Microsoft Word Remote Code Execution Vulnerability (MS12-064)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 110192
VENDOR REFERENCE: MS12-064
CVE REFERENCE: CVE-2012-0182,CVE-2012-2528
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: Microsoft Word is a proprietary word processing application written and distributed by Microsoft for Microsoft Windows and Mac OS X.

A remote code execution vulnerability exists when Microsoft Word improperly handles memory when parsing specially crafted Word files.

A remote code execution vulnerability exists in the way that Microsoft Office handles specially crafted RTF files.

Microsoft has released a security update that addresses the vulnerabilities by correcting the way Microsoft Office handles memory when parsing specially crafted files.

The security update is rated Critical for all supported editions of Microsoft Word 2007 and Microsoft Word 2010. This security update is also rated Important for all supported editions of Microsoft Word 2003; and all supported versions of Microsoft Word Viewer, Microsoft Office Compatibility Pack, Microsoft Word Automation Services on Microsoft SharePoint Server 2010, and Microsoft Office Web Apps.

IMPACT: An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Office 2003 Service Pack 3 (Microsoft Word 2003 Service Pack 3)

Microsoft Office 2007 Service Pack 2 (Microsoft Word 2007 Service Pack 2)

Microsoft Office 2007 Service Pack 3 (Microsoft Word 2007 Service Pack 3)

Microsoft Office 2010 Service Pack 1 (32-bit editions) (Microsoft Word 2010 Service Pack 1 (32-bit editions))

Microsoft Office 2010 Service Pack 1 (64-bit editions) (Microsoft Word 2010 Service Pack 1 (64-bit editions))

Microsoft Word Viewer

Microsoft Office Compatibility Pack Service Pack 2

Microsoft Office Compatibility Pack Service Pack 3

Microsoft SharePoint Server 2010 Service Pack 1 (Word Automation Services)

Microsoft Office Web Apps 2010 Service Pack 1

Refer to Microsoft Security Bulletin MS12-064 for further details.


Microsoft Works Remote Code Execution (MS12-065)
SEVERITY: Critical Critical-4 4
QUALYS ID: 110191
VENDOR REFERENCE: MS12-065
CVE REFERENCE: CVE-2012-2550
CVSS SCORES: Base 7.5 | Temporal 5.5
THREAT: Microsoft Works is a consumer level software package that includes a word processor, a spreadsheet and a database management system.
Microsoft Works also includes a built-in compatibility for the Microsoft Office document formats.

A remote code execution vulnerability exists in the way that affected versions of Microsoft Works parse specially crafted Word files, potentially causing system memory corruption.

Microsoft has released a security update that addresses the vulnerability by correcting the way Microsoft Works handles memory when parsing specially crafted files.

The security update is rated Important for Microsoft Works 9.

IMPACT: An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerability:

Security Update for Microsoft Works 9 (KB2754670)

Refer to Microsoft Security Bulletin MS12-065 for further details.

Workaround:
Do not open Word files that you receive from untrusted sources or that you receive unexpectedly from trusted sources.


Microsoft HTML Sanitization Component Elevation of Privilege Vulnerability (MS12-066)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90836
VENDOR REFERENCE: MS12-066
CVE REFERENCE: CVE-2012-2520
CVSS SCORES: Base 6.8 | Temporal 5
THREAT: HTML sanitization is a process that restricts HTML to elements that can be safely displayed in a browser.

An elevation of privilege vulnerability exists in the way HTML strings are sanitized.

Affected Software:
Microsoft InfoPath 2007 Service Pack 2
Microsoft InfoPath 2007 Service Pack 3
Microsoft InfoPath 2010 Service Pack 1 (32-bit editions)
Microsoft InfoPath 2010 Service Pack 1 (64-bit editions)
Microsoft Communicator 2007 R2
Microsoft Lync 2010 (32-bit)
Microsoft Lync 2010 (64-bit)
Microsoft Lync 2010 Attendee
Microsoft SharePoint Server 2007 Service Pack 2 (32-bit editions)
Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions)
Microsoft SharePoint Server 2007 Service Pack 2 (64-bit editions)
Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions)
Microsoft SharePoint Server 2010 Service Pack 1 (wosrv)
Microsoft SharePoint Server 2010 Service Pack 1 (coreserver)
Microsoft Groove Server 2010 Service Pack 1
Microsoft Windows SharePoint Services 3.0 Service Pack 2 (32-bit version)
Microsoft Windows SharePoint Services 3.0 Service Pack 2 (64-bit version)
Microsoft SharePoint Foundation 2010 Service Pack 1
Microsoft Office Web Apps 2010 Service Pack 1

This security update is rated Important.

IMPACT: An attacker who successfully exploited this vulnerability could read content that the attacker is not authorized to read or use the victim's identity to take actions on the targeted site or application.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft InfoPath 2007 Service Pack 2

Microsoft InfoPath 2007 Service Pack 2

Microsoft InfoPath 2007 Service Pack 3

Microsoft InfoPath 2007 Service Pack 3

Microsoft InfoPath 2010 Service Pack 1

Microsoft InfoPath 2010 Service Pack 1

Microsoft InfoPath 2010 Service Pack 1

Microsoft InfoPath 2010 Service Pack 1

Microsoft Communicator 2007 R2

Microsoft Lync 2010 (32-bit)

Microsoft Lync 2010 (64-bit)

Microsoft Lync 2010 Attendee

Microsoft Lync 2010 Attendee

Microsoft SharePoint Server 2007 Service Pack 2 (32-bit editions) (Microsoft SharePoint Server 2007 Service Pack 2 (coreserver) (32-bit editions))

Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions) (Microsoft SharePoint Server 2007 Service Pack 3 (coreserver) (32-bit editions))

Microsoft SharePoint Server 2007 Service Pack 2 (64-bit editions) (Microsoft SharePoint Server 2007 Service Pack 2 (coreserver) (64-bit editions))

Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions) (Microsoft SharePoint Server 2007 Service Pack 3 (coreserver) (64-bit editions))

Microsoft SharePoint Server 2010 Service Pack 1 (Microsoft SharePoint Server 2010 Service Pack 1 )

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-066.


Microsoft FAST Search Server 2010 for SharePoint Remote Code Execution Vulnerability (MS12-067 and KB 2737111)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90837
VENDOR REFERENCE: KB2737111
CVE REFERENCE: CVE-2012-1766,CVE-2012-1767,CVE-2012-1768,CVE-2012-1769,CVE-2012-1770,CVE-2012-1771,CVE-2012-1772,CVE-2012-1773,CVE-2012-3106,CVE-2012-3107,CVE-2012-3108,CVE-2012-3109,CVE-2012-3110
CVSS SCORES: Base 2.1 | Temporal 1.7
THREAT: Microsoft SharePoint is a Web application platform developed by Microsoft.
This security update also addresses the vulnerabilities in Microsoft SharePoint Server 2010.
The vulnerabilities could allow remote code execution in the security context of a user account with a restricted token. The security update addresses the vulnerabilities by updating the affected Oracle Outside In libraries to a non-vulnerable version.
This security update is rated Important.

Affected Software:-
FAST Search Server 2010 for SharePoint
FAST Search Server for SharePoint is affected by this issue only when Advanced Filter Pack is enabled. By default, Advanced Filter Pack is disabled.

IMPACT: In FAST Search Server 2010 for SharePoint and Microsoft SharePoint Server 2010 with Advanced Filter Pack enabled, an attacker could run arbitrary code in the context of a user account with a restricted token. By default, Advanced Filter Pack in FAST is disabled.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft FAST Search Server 2010 for SharePoint Service Pack 1

Refer to Microsoft Security Bulletin MS12-067 for further details.

Refer to Microsoft Security Advisory 2737111 to obtain additional details.

Workaround:

Disable the Advanced Filter Pack for FAST Search Server 2010 for SharePoint

On the FAST Search Server 2010 for SharePoint administration server (or single server), perform these steps:
On the Start menu, click All Programs.
Click Microsoft FAST Search Server 2010 for SharePoint.
Right-click Microsoft FAST Search Server 2010 for SharePoint shell and select Run as administrator.
At the command prompt, browse to installer\scripts under the installation folder.
Type the following command:
.\AdvancedFilterPack.ps1 -disable


Microsoft Windows Kernel Privilege Escalation Vulnerability (MS12-068)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90838
VENDOR REFERENCE: MS12-068
CVE REFERENCE: CVE-2012-2529
CVSS SCORES: Base 6.6 | Temporal 4.9
THREAT: The Windows kernel is the core of the operating system. The kernel provides system-level services such as device management and memory management, allocates processor time to processes and manages error handling.

Windows kernel is prone to an elevation of privilege vulnerability.

Microsoft has released a security update that addresses the vulnerability by correcting the way the Windows kernel handles objects in memory.

This security update resolves a privately reported vulnerability in all supported releases of Microsoft Windows except Windows 8 and Windows Server 2012. This security update is rated Important for all supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

IMPACT: This vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application designed to exploit the vulnerability. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability cannot be exploited remotely or by anonymous users.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-068.


Microsoft Windows Kerberos Denial of Service Vulnerability (MS12-069)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90835
VENDOR REFERENCE: MS12-069
CVE REFERENCE: CVE-2012-2551
CVSS SCORES: Base 4.3 | Temporal 3.2
THREAT: Kerberos is a protocol used to mutually authenticate users and services on an open and unsecured network.

Microsoft Kerberos is exposed to a remote denial of service vulnerability. The vulnerability occurs when the Microsoft Kerberos implementation in Microsoft Windows fails to properly handle a specially crafted session.

Microsoft has released an update that addresses the vulnerabilities by correcting that way the Microsoft Kerberos implementation handles a specially crafted session.

This security update is rated Important for all supported editions of Windows 7 and Windows Server 2008 R2.

IMPACT: If this vulnerability is successfully exploited, attackers can cause a denial of service.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows 7 for 32-bit Systems

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Refer to Microsoft Security Bulletin MS12-069 for further details.


Microsoft SQL Server Elevation of Privilege Vulnerability (MS12-070)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90834
VENDOR REFERENCE: MS12-070
CVE REFERENCE: CVE-2012-2552
CVSS SCORES: Base 6.4 | Temporal 4.7
THREAT: This security update resolves a privately reported vulnerability in Microsoft SQL Server on systems running SQL Server Reporting Services (SSRS). The vulnerability is a cross-site-scripting (XSS) vulnerability that could allow elevation of privilege, enabling an attacker to execute arbitrary commands on the SSRS site in the context of the targeted user.

This security update is rated Important for Microsoft SQL Server 2000 Reporting Services Service Pack 2 and for systems running SQL Server Reporting Services (SSRS) on Microsoft SQL Server 2005 Service Pack 4, Microsoft SQL Server 2008 Service Pack 2, Microsoft SQL Server 2008 Service Pack 3, Microsoft SQL Server 2008 R2 Service Pack 1, and Microsoft SQL Server 2012.

IMPACT: Successfully exploiting this vulnerability might allow a remote attacker to inject a client-side script into the user's instance of Internet Explorer. The script could spoof content, disclose information, or take any action that the user could take on the site on behalf of the targeted user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft SQL Server 2000 Reporting Services Service Pack 2

Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4

Microsoft SQL Server 2005 Service Pack 4

Microsoft SQL Server 2008 R2 Service Pack 1

Microsoft SQL Server 2008 Service Pack 2s

Microsoft SQL Server 2008 Service Pack 3

Microsoft SQL Server 2012

Refer to Microsoft Security Bulletin MS12-070 for further details.

This new vulnerability check is included in Qualys vulnerability signatures 2.2.243-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 110192
    • 110191
    • 90836
    • 90837
    • 90838
    • 90835
    • 90834
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/