August 11, 2009
Microsoft Security Bulletin: August 2009 Security Bulletin
Advisory Overview

August 11, 2009 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against 9 vulnerabilities present in Microsoft Windows that were announced today. In addition one detection for Oracle July 2009 Security Update as well as one detection for a zero day in Mozilla Firefox was also released. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription.

Vulnerability Details

Microsoft has released 9 security patches to fix newly discovered flaws in Microsoft Windows.

Qualys has released the following checks for these new vulnerabilities:


Vulnerability in ASP.NET in Microsoft Windows Could Allow Denial of Service
SEVERITY: Serious Serious-3 3
QUALYS ID: 90520
VENDOR REFERENCE: MS09-036
CVE REFERENCE: CVE-2009-1536
CVSS SCORES: Base 7.8/ Temporal 5.8
THREAT: ASP.NET is a collection of technologies within the .NET Framework that allows developers to build Web applications and XML Web services.

ASP.NET is vulnerable to a denial of service vulnerability due to the way it manages request scheduling. An attacker could exploit this vulnerability by creating a specially crafted series of anonymous HTTP requests to an affected system and thereby cause the Web server running on this system to become non-responsive. (CVE-2009-1536)

Microsoft has released a security update that addresses this vulnerability by changing the way ASP.NET manages request scheduling.

IMPACT: Successful exploitation of these vulnerabilities allows an attacker to cause a denial of service by creating crafted HTTP requests.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows Vista (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

Windows Vista (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

Windows Vista Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

Windows Vista Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

Windows Vista x64 Edition (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

Windows Vista x64 Edition (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

Windows Vista x64 Edition Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

Windows Vista x64 Edition Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

Windows Server 2008 for 32-bit Systems (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

Windows Server 2008 for 32-bit Systems (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

Windows Server 2008 for x64-based Systems (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-036.

Workaround:
- Switch to the IIS native thread pool. This can be done by the following two methods:

Method 1: Specify the value for maxConcurrentRequestsPerCPU in the registry. This setting is global and affects all application pools.

Method 2: Specify the value for maxConcurrentRequestsPerCPU for an application pool in the ASP.NET config section of an ASPNET.Config file. This setting allows configuration for individual application pools

Impact of workaround: Depending on the nature of applications running in this application pool, application performance may be affected.

For detailed instructions on applying the workarounds, please refer to the Workaround section at Microsoft Security Bulletin MS09-036.


Microsoft Telnet Could Allow Remote Code Execution
SEVERITY: Critical Critical-4 4
QUALYS ID: 42020
VENDOR REFERENCE: MS09-042
CVE REFERENCE: CVE-2009-1930
CVSS SCORES: Base 6.8/ Temporal 5
THREAT: Telnet is a bidirectional communications protocol that allows for command line remote access over the TCP protocol.

Microsoft Telnet is vulnerable to a remote code execution issue because the telnet protocol does not correctly opt in to the NTML credential reflection protections. An attacker would have to host a specially crafted Telnet server and entice an unsuspecting user into visiting the malicious server to exploit this vulnerability. (CVE-2009-1930)

Microsoft has released a security update that addresses the vulnerability by modifying the way that the Telnet service validates authentication replies in order to prevent the relay of credentials.

IMPACT: Successful exploitation of these vulnerabilities allows an attacker to run arbitrary code as the logged-on user. An attacker with administrative rights can take complete control of the affected system and then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4

Windows XP Service Pack 2 and Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS09-042 for further details.


Microsoft Remote Desktop Connection Could Allow Remote Code Execution
SEVERITY: Critical Critical-4 4
QUALYS ID: 116552
VENDOR REFERENCE: MS09-044
CVE REFERENCE: CVE-2009-1133,CVE-2009-1929
CVSS SCORES: Base 6.8/ Temporal 5
THREAT: Microsoft Remote Desktop Protocol (RDP) provides remote display and input capabilities over network connections for Microsoft Windows-based applications running on a server. The Remote Desktop Web Connection ActiveX control allows access to a computer, via the Internet, from another computer using Internet Explorer.

- A remote code execution vulnerability exists in the way that Microsoft Remote Desktop Connection processes specific parameters returned by the RDP server. This issue results in a heap overflow on the client. An attacker could convince a user to connect to a malicious RDP server, or could perform a man-in-the-middle attack and subsequently exploit this vulnerability on the Remote Desktop Connection client. (CVE-2009-1133)

- A remote code execution vulnerability exists because the Remote Desktop Web Connection ActiveX control methods do not perform sufficient parameter validation. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could potentially allow remote code execution if a user visited that page. (CVE-2009-1929)

Microsoft has released a security update that addresses these vulnerabilities by changing the way the Remote Desktop Connection deals with unexpected parameters sent by the RDP server and by correctly validating parameters passed to the Remote Desktop Connection ActiveX control methods.

IMPACT: Successful exploitation of these vulnerabilities allows an attacker to run arbitrary code as the logged-on user. An attacker with administrative rights can take complete control of the affected system and then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4 (RDP Version 5.0 )

Microsoft Windows 2000 Service Pack 4 (RDP Version 5.0 )

Microsoft Windows 2000 Service Pack 4 (RDP Version 5.1 )

Microsoft Windows 2000 Service Pack 4 (RDP Version 5.2 )

Windows XP Service Pack 2 (RDP Version 5.1 )

Windows XP Service Pack 2 (RDP Version 5.2 )

Windows XP Service Pack 2 (RDP Version 6.1 )

Windows XP Service Pack 2 (RDP Version 6.0)

Windows XP Service Pack 3 (RDP Version 6.1 )

Windows XP Service Pack 3 (RDP Version 5.2 )

Windows XP Professional x64 Edition Service Pack 2 (RDP Version 5.2)

Windows XP Professional x64 Edition Service Pack 2 (RDP Version 6.1)

Windows Server 2003 Service Pack 2 (RDP Version 5.2)

Windows Server 2003 Service Pack 2 (RDP Version 6.0)

Windows Server 2003 x64 Edition Service Pack 2 (RDP Version 5.2)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-044.

Workarounds:
For CVE-2009-1133:
1) Restrict access to mstscax.dll.

Impact of workaround #1: You will not be able to make outbound Remote Desktop connections.

For CVE-2009-1929:
1) Prevent the Remote Desktop Connection ActiveX control from running in Internet Explorer by setting the kill bit for the control in the registry.

Impact of workaround #1. Users will not be able to start remote desktop connections from within Web pages.

2) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones.

3) Configure Internet Explorer to prompt before running ActiveX controls or disable ActiveX controls in the Internet and Local intranet security zones.

Impact of workarounds #2 and #3: On visting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.


Microsoft Workstation Service Could Allow Elevation of Privilege
SEVERITY: Critical Critical-4 4
QUALYS ID: 90519
VENDOR REFERENCE: MS09-041
CVE REFERENCE: CVE-2009-1544
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: The Workstation service is a Windows component that supports the routing of remote file and network print resource requests.

- An elevation of privilege vulnerability exists in the Workstation service due to the "Double Free" condition occurring in the service. A double free condition is a condition in which a program is caused to release or free allocated memory more than once. Releasing memory that has already been freed could lead to memory corruption. An attacker could exploit the vulnerability by creating a specially crafted RPC message and sending the message to an affected system. The message could then allow an authenticated client to write arbitrary data to memory in the Workstation service address space. (CVE-2009-1544)

Microsoft has released a security update that addresses this vulnerability by correcting the manner in which the Workstation service allocates and frees memory.

IMPACT: An attacker who successfully exploits this vulnerability could run arbitrary code with elevated privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 2 and Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS09-041 for further details.

Workaround:
- TCP ports 139 and 445 should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability.

Impact of workaround: Blocking the ports can cause several windows services or applications using those ports to stop functioning.


Message Queuing Could Allow Elevation of Privilege
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90518
VENDOR REFERENCE: MS09-040
CVE REFERENCE: CVE-2009-1922
CVSS SCORES: Base 10/ Temporal 7.4
THREAT: Microsoft Message Queuing technology enables applications that are running at different times to communicate across heterogeneous networks and across systems that may be temporarily offline.

An elevation of privilege vulnerability exists in the Windows Message Queuing service (MSMQ) due to a specific flaw in the parsing of an IOCTL request to the Message Queuing service. The MSMQ service improperly checks input data before passing them to the buffer. An attacker could exploit this vulnerability by sending a specially crafted IOCTL request to the MSMQ service. (CVE-2009-1922)

Microsoft has released a security update that addresses this vulnerability by modifying the way that the MSMQ service validates input data before passing the data to the allocated buffer.

IMPACT: An attacker who successfully exploits this vulnerability could execute arbitrary code and take complete control of an affected system under the LOCAL SYSTEM context. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4

Windows XP Service Pack 2

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista

Windows Vista x64 Edition

Refer to Microsoft Security Bulletin MS09-040 for further details.

Workaround:
- Disable the Message Queuing Service. Steps on disabling the service via the Interactive Method are listed below:

1) Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.
2) Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.
3) Double-click Services.
4) Double-click Message Queuing.
5) In the Startup type list, click Disabled.
6) Click Stop, and then click OK.

- This service can also be disabled via Group Policy settings.

- The MSMQ service can also be disabled by using the following command at the command prompt (available in Windows XP and in the Microsoft Windows 2000 Resource Kit):

Sc stop MSMQ & sc config MSMQ start= disabled
Additional instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-040.

Windows Media File Processing Could Allow Remote Code Execution
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90517
VENDOR REFERENCE: MS09-038
CVE REFERENCE: CVE-2009-1545, CVE-2009-1546
CVSS SCORES: Base 9.3/ Temporal 6.9
THREAT: Audio Video Interleave (AVI) is a special case of Resource Interchange File Format (RIFF). The .avi file format is a common container format for audio and video data on a computer.

Windows Media file processing is prone to the following vulnerabilities:

- The Windows component responsible for processing AVI files does not properly handle specially crafted AVI files with malformed headers. (CVE-2009-1545)

- A remote code execution vulnerability exists in the way Microsoft Windows handles specially crafted AVI format files. (CVE-2009-1546)

An attacker can exploit these vulnerabilities by enticing an unsuspecting user into opening a specially crafted AVI file or visit a malicious Web site that contains specially crafted streaming content.

Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which AVI headers are processed and correcting the manner in which AVI data is validated.

IMPACT: If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4

Windows XP Service Pack 2 and Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

Refer to Microsoft Security Bulletin MS09-038 for further details.

Workarounds:
1) Deny access to Avifil32.dll.

On Windows 2000, Windows XP, and Windows Server 2003 systems, run the following command:
For 32bit Windows: cacls %windir%\system32\avifil32.dll /E /P everyone:N
For 64bit Windows:cacls %windir%\syswow64\avifil32.dll /E /P everyone

On Windows Vista and Windows Server 2008, run the following commands:
For 32bit Windows: icacls %windir%\system32 /restore %TEMP%\AVIFIL32_ACL.TXT

For 64bit Windows:
takeown /f %windir%\syswow64\avifil32.dll
icacls %windir%\syswow64\avifil32.dll /save %TEMP%\ AVIFIL32 _ACL.TXT
icacls %windir%\syswow64\avifil32.dll /deny everyone:(F)takeown /f

Impact of workaround #1: Applications that rely on the AVIFile API will fail to render AVI video content properly.

2) Remove HKEY_CLASSES_ROOT\CLSID\(40C3D757-D6E4-4b49-BB41-0E5BBEA28817) to prevent Windows Explorer from previewing AVI files. This can be done via the Interactive Method or by using a Managed Deployment Script. Note:This workaround is only applicable for CVE-2009-1545.

Impact of workaround #2: Windows Explorer will not provide a preview image for AVI files.

For detailed instructions on applying the workarounds, please refer to Microsoft Security Bulletin MS09-038.


Vulnerabilities in WINS Could Allow Remote Code Execution
SEVERITY: Critical Critical-4 4
QUALYS ID: 90516
VENDOR REFERENCE: MS09-039
CVE REFERENCE: CVE-2009-1923, CVE-2009-1924
CVSS SCORES: Base 10/ Temporal 7.4
THREAT: Windows Internet Name Service (WINS) is a protocol designed specifically to support NetBIOS over TCP/IP (NetBT).

- A remote code execution vulnerability exists in the Windows Internet Name Service (WINS) due to a buffer overflow caused by incorrect calculation of buffer length when processing specially crafted WINS network packets. An attacker could exploit this vulnerability by sending a specially crafted WINS replication packet to an affected system running the WINS service. (CVE-2009-1923)

- A remote code execution vulnerability exists in the default configuration of the Windows Internet Name Service (WINS) due to insufficient validation of data structures within specially crafted WINS network packets received from a trusted WINS replication partner. (CVE-2009-1924)

Microsoft has released a security update that addresses these vulnerabilities by correcting the manner in which the WINS service calculates buffer length and introducing proper data validations on received packets on the WINS server.

IMPACT: Successful exploitation of this vulnerability allows remote code execution. An attacker could gain complete control over the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Server Service Pack 4

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Refer to Microsoft Security Bulletin MS09-039 for further details.

Workaround:
- Block TCP port 42 and UDP port 42 at the firewall to prevent systems that are behind that firewall from being attacked by attempts to exploit this vulnerability.

Impact of workaround: Blocking the ports can cause several windows services or applications using those ports to stop functioning.


Microsoft Active Template Library (ATL) Remote Code Execution Vulnerability
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90515
VENDOR REFERENCE: MS09-037
CVE REFERENCE: CVE-2008-0015, CVE-2008-0020, CVE-2009-0901, CVE-2009-2493, CVE-2009-2494
CVSS SCORES: Base 9.3/ Temporal 7.3
THREAT: Microsoft Active Template Library is prone to the following vulnerabilities:

- The function CComVariant::ReadFromStream used in the ATL header does not properly restrict untrusted data read from a stream. This issue could lead to reading data directly onto the stack instead of reading it into the area of memory allocated for an array. (CVE-2008-0015)

- A remote code execution vulnerability is caused by an error in the Load method of the IPersistStreamInit interface. The Load method could allow calls to "memcopy" with untrusted data. (CVE-2008-0020)

- A remote code execution vulnerability exists in the Microsoft Active Template Library (ATL) due to an issue in the ATL headers that could allow an attacker to force VariantClear to be called on a VARIANT that has not been correctly initialized. (CVE-2009-0901)

- A vulnerability exists due to issues in the ATL headers that handle instantiation of an object from data streams. For components and controls built using ATL, unsafe usage of OleLoadFromStream could allow the instantiation of arbitrary objects which can bypass certain related security policies. (CVE-2009-2493)

- A remote code execution vulnerability exists due to a bug in the ATL header that could allow reading a variant from a stream and leaving the variant type read with an invalid variant. When deleting the variant, it would be possible to free unintended areas in memory that could be controlled by an attacker, resulting in inconsistent memory contents and execution of malicious code. (CVE-2009-2494)

Microsoft has released a security update that resolves these vulnerabilities in Microsoft Active Template Library (ATL) by modifying the ATL headers so that components and controls built using the headers can safely initialize from a data stream, and by providing updated versions of Windows components and controls built using corrected ATL headers .

IMPACT: The vulnerabilities could allow remote code execution if a user loaded a specially crafted component or control hosted on a malicious Web site. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 5.5 Service Pack 2)

Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 6 Service Pack 1)

Microsoft Windows 2000 Service Pack 4 (Windows Media Player 9)

Microsoft Windows 2000 Service Pack 4 (Windows ATL Component)

Microsoft Windows 2000 Service Pack 4 (DHTML Editing Component ActiveX Control)

Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Outlook Express 6)

Windows XP Service Pack 2 (Windows Media Player 9, Windows Media Player 10, and Windows Media Player 11)

Windows XP Service Pack 3 (Windows Media Player 9)

Windows XP Service Pack 3 (Windows Media Player 10, and Windows Media Player 11)

Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows ATL Component)

Windows XP Service Pack 2 and Windows XP Service Pack 3 (DHTML Editing Component ActiveX Control)

Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft MSWebDVD ActiveX Control)

Windows XP Professional x64 Edition Service Pack 2 (Microsoft Outlook Express 6)

Windows XP Professional x64 Edition Service Pack 2 (Windows Media Player 10)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-037.

Workarounds:
- Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.
- Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

Impact of the Workaround:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

Additional details on the workaround can be found at Microsoft Security Advisory (973882).


Microsoft Office Web Components Could Allow Remote Code Execution
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 110101
VENDOR REFERENCE: KB973472
CVE REFERENCE: CVE-2009-1136, CVE-2009-0562, CVE-2009-2496, CVE-2009-1534
CVSS SCORES: Base 9.3/ Temporal 7.5
THREAT: Microsoft Office Web Components are a collection of Component Object Model (COM) controls for publishing spreadsheets, charts, and databases to the Web, and for viewing the published components on the Web.

- Office Web Components are prone to multiple remote code execution vulnerabilities that are caused when the ActiveX control is used in Internet Explorer. An attacker could exploit the vulnerability by constructing a specially crafted Web page. The control may corrupt the system state in such a way that an attacker could run arbitrary code. (CVE-2009-1136, CVE-2009-0562, CVE-2009-2496, CVE-2009-1534)

Microsoft has released a security update that addresses these vulnerabilities by correctly handling memory allocation when the ActiveX control is used in Internet Explorer, correcting validation logic for Office Web Components ActiveX control methods, and performing additional parameter validation.

Previously, Microsoft had released Microsoft Security Advisory (973472) for this vulnerability.

IMPACT: Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the application. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Office XP Service Pack 3

Microsoft Office 2003 Service Pack 3

Microsoft Office 2000 Web Components Service Pack 3

Microsoft Office XP Web Components Service Pack 3

Microsoft Office 2003 Web Components Service Pack 3

Microsoft Office 2003 Web Components Service Pack 1 for the 2007 Microsoft Office System

Microsoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3

Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3

Microsoft Internet Security and Acceleration Server 2006 Standard Edition Service Pack 1

Microsoft Internet Security and Acceleration Server 2006 Enterprise Edition Service Pack 1

Microsoft BizTalk Server 2002

Microsoft Visual Studio .NET 2003 Service Pack 1

Microsoft Office Small Business Accounting 2006

Refer to Microsoft Security Bulletin MS09-043 for further details.

Workarounds:
1) Prevent Office Web Components Library from running in Internet Explorer by setting the kill bit for the control in the registry. Refer to Microsoft article KB240797 for information on setting the kill bits.

Impact of workaround #1: Disabling the Office Web Component prevents Internet Explorer from instantiating the control. This configuration causes program compatibility issues when Office Web Components functionality is required.

2) Unregister the Office Web Components Library.

Impact of workaround #2: Applications requiring Office Web Components functionality will not function.

3) Restrict Web sites to only your trusted Web sites.

4) Set Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX controls in these zones.

Detailed instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-043.

This new vulnerability check is included in Qualys vulnerability signatures v1.23.51-4. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 90520
    • 42020
    • 116552
    • 90519
    • 90518
    • 90517
    • 90516
    • 90515
    • 110101
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/