January 08, 2013
Microsoft Security Bulletin: January 8
Advisory Overview

January 8, 2013 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 12 vulnerabilities that were fixed in 7 bulletin(s) announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription. Please visit our podcast page for patch tuesday prioritization and summary.

Vulnerability Details

Microsoft has released 7 security bulletins to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:


Microsoft Windows Print Spooler Components Remote Code Execution Vulnerability (MS13-001)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90851
VENDOR REFERENCE: MS13-001
CVE REFERENCE: CVE-2013-0011
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: The Print Spooler service manages the printing process, which includes such tasks as retrieving the location of the correct printer driver, loading that driver, spooling high-level function calls into a print job and scheduling print jobs.

A remote code execution vulnerability is caused when the Windows Print Spooler fails to handle a specially crafted print job.

Microsoft has released a security update that addresses the vulnerability by correcting how the Windows Print Spooler handles specially crafted print jobs.

This security update is rated Critical for all supported editions of Windows 7 and Windows Server 2008 R2.

IMPACT: An attacker who successfully exploits this vulnerability could run arbitrary code on a user's system with system privileges and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts.
SOLUTION: Patch:
Following are links for downloading patches to fix this vulnerability:

Windows 7 for 32-bit Systems

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Refer to Microsoft Security Bulletin MS13-001 for further details.

Workaround:
1) Disabling the Print Spooler service will help protect the affected system from attempts to exploit this vulnerability.

Impact of workaround #1 - Print-related components will not function properly; printing will be disabled.


Microsoft XML Core Services Remote Code Execution Vulnerability (MS13-002)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90852
VENDOR REFERENCE: MS13-002
CVE REFERENCE: CVE-2013-0006,CVE-2013-0007
CVSS SCORES: Base 9.3 | Temporal 7.3
THREAT: This security update resolves two privately reported vulnerabilities in Microsoft XML Core Services by modifying the way that Microsoft XML Core Services parses XML content.

Affected Software:
This security update is rated Critical for Microsoft XML Core Services 3.0, Microsoft XML Core Services 4.0, and Microsoft XML Core Services 6.0 on all affected editions of Windows XP, Windows Vista, Windows 7, Windows 8, and Windows RT; Critical for Microsoft XML Core Services 5.0 when installed with all supported editions of Microsoft Office 2003, Microsoft Office 2007, Microsoft Word Viewer, Microsoft Office Compatibility Pack, Microsoft Expression Web, Microsoft SharePoint Server 2007, and Microsoft Groove Server 2007; Moderate for Microsoft XML Core Services 3.0, 4.0, and 6.0 on all affected editions of Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012.

IMPACT: The vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker would have no way to force users to visit such a website. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes the user to the attacker's website.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Microsoft XML Core Services 4.0)

Windows XP Service Pack 3 (Microsoft XML Core Services 6.0)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft XML Core Services 4.0)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft XML Core Services 6.0)

Windows Server 2003 Service Pack 2 (Microsoft XML Core Services 4.0)

Windows Server 2003 Service Pack 2 (Microsoft XML Core Services 6.0)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft XML Core Services 4.0)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft XML Core Services 6.0)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft XML Core Services 3.0)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft XML Core Services 4.0)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft XML Core Services 6.0)

Windows Vista Service Pack 2 (Microsoft XML Core Services 4.0)

Windows Vista Service Pack 2 (Microsoft XML Core Services 6.0)

Windows Vista x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

Windows Vista x64 Edition Service Pack 2 (Microsoft XML Core Services 4.0)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-002.

Workaround:
1) Restrict access to msxml3.dll or msxml6.dll
Impact of workaround. Websites that use XML may no longer display or function correctly.


Microsoft System Center Operations Manager Elevation of Privilege Vulnerability (MS13-003)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90855
VENDOR REFERENCE: MS13-003
CVE REFERENCE: CVE-2013-0009,CVE-2013-0010
CVSS SCORES: Base 10 | Temporal 7.4
THREAT: System Center Operations Manager (SCOM) is a cross-platform data center management system for operating systems and hypervisors.

A cross-site scripting (XSS) vulnerability exists in System Center Operations Manager that could allow specially crafted script code to run under the guise of the server. This is caused when the System Center Operations Manager improperly validates input. (CVE-2013-0009,CVE-2013-0010)

Affected Software:
Microsoft System Center Operations Manager 2007 Service Pack 1
Microsoft System Center Operations Manager 2007 R2

This security update is rated Important for all supported releases.

IMPACT: An attacker who successfully exploits this vulnerability could inject a client-side script in the user's browser. The script could spoof content, disclose information, or take any action that the user could take on the affected website on behalf of the targeted user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft System Center Operations Manager 2007 R2

Refer to Microsoft Security Bulletin MS13-003 for further details.

The security update for Microsoft System Center Operations Manager 2007 Service Pack 1 is unavailable at this time. Microsoft will issue the update when testing is complete.


Microsoft .NET Framework Elevation of Privilege (MS13-004)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90857
VENDOR REFERENCE: MS13-004
CVE REFERENCE: CVE-2013-0001,CVE-2013-0002,CVE-2013-0003,CVE-2013-0004
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.

Microsoft .NET Framework is exposed to the following vulnerabilities:

1) An information disclosure vulnerability exists in the way the Windows Forms in .NET Framework handles pointers to unmanaged memory locations. (CVE-2013-0001).
2) An elevation of privilege vulnerability exists in the way that a Windows Forms method included in the .NET Framework validates the number of objects in memory before copying those objects into an array. (CVE-2013-0002).
3) An elevation of privilege vulnerability exists in the way that a System.DirectoryServices.Protocols (S.DS.P) namespace method in the .NET Framework validates the size of objects in memory prior to copying those objects into an array (CVE-2013-0003).
4) An elevation of privilege vulnerability exists in the way that .NET Framework validates the permissions of certain objects in memory. (CVE-2013-0004).

This security update is rated Important for Microsoft .NET Framework 1.0 Service Pack 3, Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4, and Microsoft .NET Framework 4.5 on all supported editions of Microsoft Windows. This update has no severity rating for Microsoft .NET Framework 3.0 Service Pack 2.

IMPACT: Successfully exploiting these security vulnerabilities might allow a remote attacker to install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Microsoft .NET Framework 1.0 Service Pack 3)

Windows XP Service Pack 3 (Microsoft .NET Framework 1.1 Service Pack 1)

Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)

Windows XP Service Pack 3 (Microsoft .NET Framework 4)

Windows XP Service Pack 3 (Microsoft .NET Framework 3.0 Service Pack 2)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.0 Service Pack 2)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

Windows Vista Service Pack 2 (Microsoft .NET Framework 4)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-004.

Workaround:
Workarounds for CVE-2013-0002,CVE-2013-0003,CVE-2013-0004.

To help protect against this vulnerability, change your settings to prompt before running XAML browser applications (XBAPs) or to disable XBAPs in the Internet and Local intranet security zones as follows: In Internet Explorer, click the Tools menu and then select Internet Options. Click the Security tab, click Internet, and then click Custom level. Under Settings, for Loose XAML, click Prompt or Disable, and then click OK. Click the Security tab, click Internet, and then click Custom level. Under Settings, for XAML browser applications, click Prompt or Disable, and then click OK. Click the Security tab, click Internet, and then click Custom level. Under Settings, for XPS documents, click Prompt or Disable, and then click OK. On the Security tab, click Custom level. Under .NET Framework-reliant components, set Run components not signed with Authenticode to either Prompt or Disable, and then click OK. Repeat this step for Run components signed with Authenticode, and then click OK. Click Local intranet, and then click Custom Level. Repeat steps 3 and 4. If you are prompted to confirm that you want to change these settings, click Yes. Click OK to return to Internet Explorer


Windows Kernel-Mode Driver Elevation of Privilege (MS13-005)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90854
VENDOR REFERENCE: MS13-005
CVE REFERENCE: CVE-2013-0008
CVSS SCORES: Base 6.8 | Temporal 5
THREAT: This security update resolves one privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker runs a specially crafted application.

The security update addresses the vulnerability by correcting the way that the Windows kernel-mode driver handles window broadcast messages.

This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT.

IMPACT: Successfully exploiting these security vulnerabilities could allow an attacker to run arbitrary code in the context of a higher Integrity Level (IL) process. If a user is logged in with administrative user rights, an attacker could take complete control of the affected system.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for 64-bit Systems

Windows Server 2012

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-005.


Microsoft Windows Security Feature Bypass Vulnerability (MS13-006)
SEVERITY: Serious Serious-3 3
QUALYS ID: 90853
VENDOR REFERENCE: MS13-006
CVE REFERENCE: CVE-2013-0013
CVSS SCORES: Base 8.8 | Temporal 6.5
THREAT: Microsoft Windows SSL/TLS (Secure Socket Layer and Transport Layer Security) contains a security feature bypass vulnerability due to improperly handling SSL/TLS session version negotiation.

Microsoft released a security update that addresses the vulnerability by modifying the way that the Windows SSL provider component handles encrypted network packets.

The security update is rated Important for all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 8, Windows Server 2008 R2, Windows Server 2012 and Windows RT.

IMPACT: An attacker who successfully exploits this vulnerability could silently downgrade an SSL version 3 or TLS connection to SSL version 2, which supports weak encryption cyphers. Man-in-the-middle attacks are possible.

SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows 8 for 32-bit Systems

Windows 8 for 64-bit Systems

Windows Server 2012

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-006.

Workaround:
Configure Internet Explorer to disable SSLv2 and configure Internet Information Services to disable SSLv2.


Microsoft Open Data Protocol Denial of Service Vulnerability (MS13-007)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90856
VENDOR REFERENCE: MS13-007
CVE REFERENCE: CVE-2013-0005
CVSS SCORES: Base 7.1 | Temporal 5.3
THREAT: The Open Data (OData) protocol is a web protocol for querying and updating data that provides a way to unlock your data and free it from silos that exist in applications today.

A denial of service vulnerability exists in the OData specification. That is caused when the WCF Replace function improperly sanitizes specially crafted values, allowing the replication of data and the exhaustion of system resources. (CVE-2013-0005)

Affected Software:
Windows XP Service Pack 3 and Windows XP Professional x64 Edition Service Pack 2
- Microsoft .NET Framework 3.5 Service Pack 1)
- Microsoft .NET Framework 4
Windows Server 2003 Service Pack 2
- Microsoft .NET Framework 3.5 Service Pack 1
- Microsoft .NET Framework 4
Windows Vista Service Pack 2
- Microsoft .NET Framework 3.5 Service Pack 1
- Microsoft .NET Framework 4
Windows Server 2008 Service Pack 2
- Microsoft .NET Framework 3.5 Service Pack 1
- Microsoft .NET Framework 4
Windows 7, Windows 7 Service Pack 1
- Microsoft .NET Framework 3.5.1
- Microsoft .NET Framework 4
Windows Server 2008 R2, Windows Server 2008 R2 Service Pack 1
- Microsoft .NET Framework 3.5.1
- Microsoft .NET Framework 4
Windows 8
- Microsoft .NET Framework 3.5
Windows Server 2012
- Microsoft .NET Framework 3.5
- Management OData IIS Extension

This security update is rated Important for all supported releases.

IMPACT: An attacker could use this vulnerability to cause a denial of service attack and disrupt the availability of sites that use .NET WCF Services.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Microsoft .NET Framework 3.5 Service Pack 1)

Windows XP Service Pack 3 (Microsoft .NET Framework 4)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 3.5 Service Pack 1)

Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 4)

Windows Vista Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

Windows Vista Service Pack 2 (Microsoft .NET Framework 4)

Windows Vista x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

Windows Vista x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft .NET Framework 4)

Windows 7 for 32-bit Systems (Microsoft .NET Framework 3.5.1)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-007.


Microsoft Windows Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10 (KB2796096)
SEVERITY: Critical Critical-4 4
QUALYS ID: 100135
VENDOR REFERENCE: KB2796096
CVE REFERENCE: CVE-2013-0630
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: Microsoft released an update for Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8 and Windows Server 2012. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10.

Affected Software:
Adobe Flash Player in Internet Explorer 10

IMPACT: Successful exploitation allows attackers to cause the application to crash and potentially allow them to take control of the affected system.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Update for Internet Explorer Flash Player for Windows 8

Update for Internet Explorer Flash Player for Windows 8 x64-based systems

Update for Internet Explorer Flash Player for Windows Server 2012

Refer to KB2796096 to obtain further information.

This new vulnerability check is included in Qualys vulnerability signatures 2.2.330-4. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 90851
    • 90852
    • 90855
    • 90857
    • 90854
    • 90853
    • 90856
    • 100135
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/