August 14, 2012
Microsoft Security Bulletin: August 14
Advisory Overview

August 14, 2012 - Qualys® Vulnerability R&D Lab has released new vulnerability checks in QualysGuard® to protect organizations against vulnerabilities patched in 9 security bulletins that were released today. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their QualysGuard subscription. Please visit our podcast page for patch tuesday prioritization and summary.

Vulnerability Details

Microsoft has released security patches to fix newly discovered flaws in Microsoft Windows. Qualys has released the following checks for these new vulnerabilities:


Microsoft Internet Explorer Cumulative Security Update (MS12-052)
SEVERITY: Critical Critical-4 4
QUALYS ID: 100125
VENDOR REFERENCE: MS12-052
CVE REFERENCE: CVE-2012-1526 | CVE-2012-2521 | CVE-2012-2522 | CVE-2012-2523
CVSS SCORES: Base 6.8 | Temporal 5
THREAT: Microsoft Internet Explorer is a Web browser available for Microsoft Windows.

Internet Explorer is prone to multiple vulnerabilities that could allow remote code execution.

Microsoft has released a security update that addresses the vulnerabilities by modifying the way Internet Explorer handles objects in memory.

This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows servers.

IMPACT: The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3 (Internet Explorer 6)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 Service Pack 2 (Internet Explorer 6)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

Windows XP Service Pack 3 (Internet Explorer 7)

Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 Service Pack 2 (Internet Explorer 7)

Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

Windows Vista Service Pack 2 (Internet Explorer 7)

Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)

Windows Server 2003 Service Pack 2 (Internet Explorer 8)

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-052.

Workaround:
Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones. Add sites that you trust to the Internet Explorer Trusted sites zone. Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.


Microsoft Remote Desktop Remote Code Execution Vulnerability (MS12-053)
SEVERITY: Urgent Urgent-5 5
QUALYS ID: 90825
VENDOR REFERENCE: MS12-053
CVE REFERENCE: CVE-2012-2526
CVSS SCORES: Base 9.3 | Temporal 7.3
THREAT: Remote Desktop Protocol (RDP) lets users create a virtual session on their desktop computers. RDP allows remote users to access all of the data and applications on their computers.

The vulnerability occurs when the Remote Desktop Protocol processes a sequence of specially crafted packets, resulting in the access in memory of an object that has been deleted.

This security update is rated Critical.

Affected Software:
Windows XP SP3.

IMPACT: The vulnerability could allow remote code execution if an attacker sends a sequence of specially crafted RDP packets to an affected system. By default, RDP is not enabled on any Windows operating system. Systems that do not have RDP enabled are not at risk.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Refer to Microsoft Security Bulletin MS12-053 for further details.

Workaround:
1. Block TCP port 3389 at the enterprise perimeter firewall
2. Disable Remote Desktop feature if no longer required


Windows Networking Components Could Allow Remote Code Execution (MS12-054)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90829
VENDOR REFERENCE: MS12-054
CVE REFERENCE: CVE-2012-1850 | CVE-2012-1851 | CVE-2012-1852 | CVE-2012-1853
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: Multiple Windows Networking Components are exposed to multiple vulnerabilities that could allow remote code execution.

Microsoft has released a security update that addresses the vulnerabilities by correcting how the Windows Print Spooler handles specially crafted responses and how Windows networking components handle Remote Administration Protocol responses.

This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003; Important for all supported editions of Windows Vista; and Moderate for all supported editions of Windows Server 2008, Windows 7, and Windows 2008 R2.

IMPACT: The most severe vulnerabilities could allow remote code execution on a user's system with system privileges.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-054.

Workaround:
Disable the LanmanWorkstation service. Disable the Print Spooler service.


Microsoft Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (MS12-055)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90826
VENDOR REFERENCE: MS12-055
CVE REFERENCE: CVE-2012-2527
CVSS SCORES: Base 6.6 | Temporal 4.9
THREAT: The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.

An elevation of privilege vulnerability exists when the Windows kernel-mode driver improperly handles objects in memory. (CVE-2012-2527)

Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

This security update is rated Important.

IMPACT: An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Service Pack 3

Windows XP Professional x64 Edition Service Pack 2

Windows Server 2003 Service Pack 2

Windows Server 2003 x64 Edition Service Pack 2

Windows Server 2003 with SP2 for Itanium-based Systems

Windows Vista Service Pack 2

Windows Vista x64 Edition Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for Itanium-based Systems Service Pack 2

Windows 7 for 32-bit Systems

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems

Windows 7 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for Itanium-based Systems

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-055.


Microsoft JScript and VBScript Scripting Engines Remote Code Execution Vulnerability (MS12-056)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90827
VENDOR REFERENCE: MS12-056
CVE REFERENCE: CVE-2012-2523
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: JScript is an interpreted, object-based scripting language that is often used to make Web sites more flexible or interactive. VBScript (Visual Basic Script) is an interpreted, object-based scripting language that is often used to make Web sites more flexible or interactive.

A remote code execution vulnerability exists in the way that the JScript and VBScript engines calculate the size of an object in memory during a copy operation. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

This security update is rated Important for JScript 5.8 and VBScript 5.8 on 64-bit Windows clients. This security update is also rated Low for JScript 5.8 and VBScript 5.8 on 64-bit Windows servers.

IMPACT: Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Windows XP Professional x64 Edition Service Pack 2 (JScript 5.8 and VBScript 5.8)

Windows Server 2003 x64 Edition Service Pack 2 (JScript 5.8 and VBScript 5.8)

Windows Vista x64 Edition Service Pack 2 (JScript 5.8 and VBScript 5.8)

Windows Server 2008 for x64-based Systems Service Pack 2 (JScript 5.8 and VBScript 5.8)

Windows 7 for x64-based Systems (JScript 5.8 and VBScript 5.8)

Windows 7 for x64-based Systems Service Pack 1 (JScript 5.8 and VBScript 5.8)

Windows Server 2008 R2 for x64-based Systems (JScript 5.8 and VBScript 5.8)

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (JScript 5.8 and VBScript 5.8)

Windows Server 2008 R2 for Itanium-based Systems (JScript 5.8 and VBScript 5.8)

Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (JScript 5.8 and VBScript 5.8)

Refer to Microsoft Security Bulletin MS12-056 for further details.

Workaround:
1) Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones.
2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
3) Use 32-bit version of Internet Explorer


Microsoft Office Remote Code Execution Vulnerabilities (MS12-057)
SEVERITY: Critical Critical-4 4
QUALYS ID: 110190
VENDOR REFERENCE: MS12-057
CVE REFERENCE: CVE-2012-2524
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: Microsoft Office is a proprietary suite of Office applications.

A vulnerability occurs when Microsoft Office does not properly handle specially crafted CGM files causing corruption of memory that could lead to arbitrary code execution.

Microsoft has released a security update that addresses the vulnerability by disabling the loading of CGM graphics files in Microsoft Office applications.

This security update is rated Important for all supported editions of Microsoft Office 2007 and Microsoft Office 2010.

IMPACT: An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Office 2007 Service Pack 2

Microsoft Office 2007 Service Pack 2

Microsoft Office 2007 Service Pack 3

Microsoft Office 2007 Service Pack 3

Microsoft Office 2010 Service Pack 1

Microsoft Office 2010 Service Pack 1

Microsoft Office 2010 Service Pack 1

Microsoft Office 2010 Service Pack 1

Refer to Microsoft Security Bulletin MS12-057 for further details.

Workaround:
Do not open Office files or embed CGM files received from untrusted sources.


Microsoft Exchange Server and FAST Search Server 2010 for SharePoint Parsing Remote Code Execution Vulnerability (MS12-058 and KB 2737111)
SEVERITY: Serious Serious-3 3
QUALYS ID: 74254
VENDOR REFERENCE: KB2737111
CVE REFERENCE: CVE-2012-1766 | CVE-2012-1767 | CVE-2012-1768 | CVE-2012-1769 | CVE-2012-1770 | CVE-2012-1771 | CVE-2012-1772 | CVE-2012-1773 | CVE-2012-3106 | CVE-2012-3107 | CVE-2012-3108 | CVE-2012-3109 | CVE-2012-3110
CVSS SCORES: Base 2.1 | Temporal 1.7
THREAT: Microsoft Exchange Server is a messaging and collaborative software product that provides support for electronic mail, calendaring, contacts and tasks, mobile and Web-based access to information, and data storage.
The vulnerabilities exist are caused the way files are parsed by the third-party Oracle Outside In libraries .
This security update resolves publicly disclosed vulnerabilities in Microsoft Exchange Server WebReady Document Viewing. The transcoding service in Exchange that is used for WebReady Document Viewing is running in the LocalService account.
This security update is rated Critical.

Affected Software:-
Microsoft Exchange Server 2007 Service Pack 3
Microsoft Exchange Server 2010 Service Pack 1
Microsoft Exchange Server 2010 Service Pack 2
Microsoft SharePoint Server 2010 Service Pack 1
FAST Search Server 2010 for SharePoint

IMPACT: An attacker who successfully exploits these vulnerabilities could run arbitrary code under the process that parsing of the specially crafted files.
In the case of Microsoft Exchange Server 2007 or Microsoft Exchange Server 2010, an attacker could run arbitrary code in the context of LocalService. An attacker could then install programs; view, change, or delete data; or take any other action that the server process has access to.
In the case of FAST Search Server 2010 for SharePoint and Microsoft SharePoint Server 2010 with Advanced Filter Pack enabled, an attacker could run arbitrary code in the context of a user account with a restricted token. By default, Advanced Filter Pack in FAST is disabled.
SOLUTION: Refer to Microsoft Security Advisory 2737111 to obtain additional details.

Workaround:
1. Disable transcoding service
Log in to the Exchange Management Shell as an Exchange Organization Administrator.
Issue the following PowerShell command:
Get-OwaVirtualDirectory | where {$_.OwaVersion -eq 'Exchange2007' -or $_.OwaVersion -eq 'Exchange2010'} | Set-OwaVirtualDirectory - WebReadyDocumentViewingOnPubli cComputersEnabled:$False - WebReadyDocumentViewingOnPriva teComputersEnabled:$False

Impact of workaround.
OWA users may not be able to preview the content of email attachments.

2. Disable the Advanced Filter Pack
On the FAST Search Server 2010 for SharePoint administration server (or single server), perform these steps:
On the Start menu, click All Programs.
Click Microsoft FAST Search Server 2010 for SharePoint.
Right-click Microsoft FAST Search Server 2010 for SharePoint shell and select Run as administrator.
At the command prompt, browse to installer\scripts under the installation folder.
Type the following command:
.\AdvancedFilterPack.ps1 -disable


Microsoft Visio and Visio Viewer 2010 Remote Code Execution Vulnerability (MS12-059)
SEVERITY: Critical Critical-4 4
QUALYS ID: 110189
VENDOR REFERENCE: MS12-059
CVE REFERENCE: CVE-2012-1888
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: Microsoft Visio is diagramming software for Microsoft Windows. It uses vector graphics to create diverse diagrams.

This security update resolves a privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted Visio file. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.

This security update is rated Important for all supported editions of Microsoft Visio 2010 and Microsoft Visio Viewer 2010.

IMPACT: Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Visio 2010 Service Pack 1 (32-bit editions)

Microsoft Visio 2010 Service Pack 1 (64-bit editions)

Microsoft Visio Viewer 2010 Service Pack 1 (32-bit Edition)

Microsoft Visio Viewer 2010 Service Pack 1 (64-bit Edition)

Refer to Microsoft Security Bulletin MS12-059 for further details.

Workaround:
Do not open Office files that you receive from untrusted sources or that you receive unexpectedly from trusted sources


Microsoft Windows Common Controls Remote Code Execution Vulnerability (MS12-060)
SEVERITY: Critical Critical-4 4
QUALYS ID: 90828
VENDOR REFERENCE: MS12-06
CVE REFERENCE: CVE-2012-1856
CVSS SCORES: Base 9.3 | Temporal 6.9
THREAT: Microsoft Windows Common Controls are ActiveX controls contained in the MSCOMCTL.OCX file.

A remote code execution vulnerability exists in the Windows common controls. The vulnerability occurs when an ActiveX control corrupts the system in a way that allows an attacker to execute arbitrary code. (CVE-2012-1856)

Affected Software:
Microsoft Office 2003 Service Pack 3
Microsoft Office 2003 Web Components Service Pack 3
Microsoft Office 2007 Service Pack 2
Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 (32-bit editions)
Microsoft Office 2010 Service Pack 1 (32-bit editions)
Microsoft SQL Server 2000 Analysis Services Service Pack 4
Microsoft SQL Server 2000 Service Pack 4
Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4
Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4
Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4
Microsoft SQL Server 2005 for x64-based Systems Service Pack 4
Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2
Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3
Microsoft SQL Server 2008 for x64-based Systems Service Pack 2
Microsoft SQL Server 2008 for x64-based Systems Service Pack 3
Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2
Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3
Microsoft SQL Server 2008 R2 for 32-bit
Microsoft SQL Server 2008 R2 for 32-bit Systems Service Pack 1
Microsoft SQL Server 2008 R2 for 32-bit Systems Service Pack 2
Microsoft SQL Server 2008 R2 for x64-based Systems
Microsoft SQL Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft SQL Server 2008 R2 for x64-based Systems Service Pack 2
Microsoft SQL Server 2008 R2 for Itanium-based Systems
Microsoft Commerce Server 2002 Service Pack 4
Microsoft Commerce Server 2007 Service Pack 2
Microsoft Commerce Server 2009
Microsoft Commerce Server 2009 R2
Microsoft Visual FoxPro 8.0 Service Pack 1
Microsoft Visual FoxPro 9.0 Service Pack 2
Visual Basic 6.0 Runtime
Microsoft Host Integration Server 2004 Service Pack 1

This security update is rated Critical.

IMPACT: An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
SOLUTION: Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft Office 2003 Service Pack 3

Microsoft Office 2003 Web Components Service Pack 3

Microsoft Office 2007 Service Pack 2

Microsoft Office 2007 Service Pack 3

Microsoft Office 2010 Service Pack 1 (32-bit Editions)

Microsoft SQL Server 2000 Service Pack 4

Microsoft SQL Server 2000 Analysis Services Service Pack 4

Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4

Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4

Microsoft SQL Server 2005 for x64-based Systems Service Pack 4

Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4

Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2

Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3

Microsoft SQL Server 2008 for x64-based Systems Service Pack 2

Microsoft SQL Server 2008 for x64-based Systems Service Pack 3

Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2

Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3

Microsoft SQL Server 2008 R2 for 32-bit Systems

Microsoft SQL Server 2008 R2 for 32-bit Systems Service Pack 1

For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-060.

This new vulnerability check is included in Qualys vulnerability signatures 2.2.199-3. Each QualysGuard account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the QualysGuard HOME menu, select the Account Info tab.

SELECTIVE SCAN INSTRUCTIONS USING QUALYSGUARD:

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 100125
    • 90825
    • 90829
    • 90826
    • 90827
    • 110190
    • 74254
    • 110189
    • 90828
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if QualysGuard is unable to logon to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Matrix Report, available from the QualysGuard HOME page.


Technical Support
For more information, customers may contact Qualys Technical Support directly at support@qualys.com or by telephone toll free at:
US: 1 866.801.6161 | EMEA: 33 1 44.17.00.41 | UK: +44 1753 872102
About QualysGuard
QualysGuard is an on-demand security audit service delivered over the web that enables organizations to effectively manage their vulnerabilities and maintain control over their network security with centralized reports, verified remedies, and full remediation workflow capabilities with trouble tickets. QualysGuard provides comprehensive reports on vulnerabilities including severity levels, time to fix estimates and impact on business, plus trend analysis on security issues. By continuously and proactively monitoring all network access points, QualysGuard dramatically reduces security managers' time researching, scanning and fixing network exposures and enables companies to eliminate network vulnerabilities before they can be exploited.

Access for QualysGuard customers: https://qualysguard.qualys.com

Free trial of QualysGuard service: http://www.qualys.com/forms/trials/qualysguard_trial/