Microsoft security alert.
April 12, 2005
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 19 vulnerabilities that were fixed in 8 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Word Vulnerability Could Allow Remote Code Execution (MS05-023)
- Severity
- Urgent 5
- Qualys ID
- 110031
- Vendor Reference
- MS05-023
- CVE Reference
- CVE-2004-0963, CVE-2005-0558
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
Microsoft Word on the host is missing the patch described in Security Bulletin MS05-023.
A vulnerability exists in Microsoft Word that could allow an attacker to run arbitrary code on a user's system. If a user is logged on with administrative privileges, an attacker who successfully exploits this vulnerability could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts with full privileges.
- Consequence
- Successful exploitation of this issue can result in arbitrary code execution.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Word 2003 Viewer :
http://www.microsoft.com/downloads/details.aspx?familyid=95E24C87-8732-48D5-8689-AB826E7B8FDF&displaylang=enMicrosoft Word 2000 and Microsoft Works Suite 2001 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9F4B6868-2F94-478F-B0BC-0DA3E0571523Microsoft Word 2002, Microsoft Works Suite 2002, Microsoft Works Suite 2003, and Microsoft Works Suite 2004 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=34998255-E004-4A29-9418-35C5818E54CBMicrosoft Office Word 2003 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9158279D-4421-4932-9318-02CA829A9B43Refer to Micrsoft Security Bulletin MS05-023 for further details.
-
Microsoft Windows Shell Code Execution (MS05-016)
- Severity
- Critical 4
- Qualys ID
- 90242
- Vendor Reference
- MS05-016
- CVE Reference
- CVE-2005-0063
- CVSS Scores
- Base 7.5 / Temporal 6.2
- Description
-
A remote code execution vulnerability exists in the Windows Shell because of the way that it handles application association.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
April Security Updates for Embedded (KB893086)
- Consequence
- If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create acounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=A7511A19-ADD5-4793-92AC-25E953CE405CMicrosoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=51679BB1-A61B-47AC-A943-F9F306EF987BMicrosoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
http://www.microsoft.com/downloads/details.aspx?FamilyId=D513C252-FF70-46E3-BD79-077A336A974DMicrosoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
http://www.microsoft.com/downloads/details.aspx?FamilyId=32ADAB00-6ED3-4418-8539-7FA468AD5DBDMicrosoft Windows Server 2003 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=F803F008-5EE8-4BBE-8136-BC21708D1025Microsoft Windows Server 2003 for Itanium based Systems :
http://www.microsoft.com/downloads/details.aspx?FamilyId=32ADAB00-6ED3-4418-8539-7FA468AD5DBDRefer to Micrsoft Security Bulletin MS05-016 for further details.
-
Microsoft Message Queuing Buffer Overflow (MS05-017)
- Severity
- Urgent 5
- Qualys ID
- 90240
- Vendor Reference
- MS05-017
- CVE Reference
- CVE-2005-0059
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
Microsoft Message Queuing (MSMQ) attempts to facilitate process communication over the Internet. It attempts to guarantee message delivery through priority queuing mechanisms.
A remote code execution vulnerability exists in the Message Queuing service.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
April Security Updates for Embedded (KB892944)
- Consequence
- An attacker who successfully exploits this vulnerability could remotely take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=99A8EE12-4BD6-43F5-A43F-124E0E2C2283Microsoft Windows XP Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=D72B7198-93A8-4652-B505-8E51FC5EEAC3Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9124BA48-73A8-4C94-AA46-CE9A9D1E1198Refer to Micrsoft Security Bulletin MS05-017 for further details.
-
Windows Multiple Denial of Service and Privilege Elevation Vulnerabilities (MS05-018)
- Severity
- Urgent 5
- Qualys ID
- 90243
- Vendor Reference
- MS05-018
- CVE Reference
- CVE-2005-0060, CVE-2005-0061, CVE-2005-0550, CVE-2005-0551
- CVSS Scores
- Base 10 / Temporal 7.8
- Description
-
Microsoft has released Security Bulletin MS05-018 to address the multiple denial of service and privilege elevation vulnerabilities.
Multiple vulnerabilities exist in font processing, CRSS.exe client/server runtime server subsystem, object management and the Windows kernel.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
April Security Updates for Embedded (KB890859)
- Consequence
- An attacker who successfully exploits this vulnerability could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts that have full privileges.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=992C1BF9-A2C0-49D2-9059-A1DAD6703213Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=F0683E2B-8E8F-474F-B8D8-46C4C33FCE99Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
http://www.microsoft.com/downloads/details.aspx?FamilyId=B52F9281-570F-4F7A-8DEF-5AEAB6E8E002Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
http://www.microsoft.com/downloads/details.aspx?FamilyId=C51D6AD5-93BA-4717-A5DB-5CE78F70592EMicrosoft Windows Server 2003 for Itanium based Systems :
http://www.microsoft.com/downloads/details.aspx?FamilyId=C51D6AD5-93BA-4717-A5DB-5CE78F70592ERefer to Micrsoft Security Bulletin MS05-018 for further details.
-
Windows TCP/IP Remote Code Execution and Denial of Service Vulnerabilities (MS05-019)
- Severity
- Critical 4
- Qualys ID
- 90244
- Vendor Reference
- MS05-019
- CVE Reference
- CVE-2004-0230, CVE-2004-0790, CVE-2004-0791, CVE-2004-1060, CVE-2005-0048, CVE-2005-0688
- CVSS Scores
- Base 7.5 / Temporal 5.9
- Description
-
Microsoft Security Update MS05-019 was not found on the host. This update resolves the issues described below.
IP Validation Vulnerability:
A remote code execution vulnerability allows an attacker to send a specially crafted IP message to an affected system. An attacker who successfully exploits this vulnerability could cause the affected system to remotely execute code. However, attempts to exploit this vulnerability would most likely result in a denial of service. (CAN-2005-0048)ICMP Connection Reset Vulnerability:
A denial of service vulnerability allows an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system. An attacker who successfully exploits this vulnerability could cause the affected system to reset existing TCP connections. (CAN-2004-0790)ICMP Path MTU Vulnerability:
A denial of service vulnerability allows an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system, which could cause network performance to degrade and potentially stop the affected system from responding to requests. (CAN-2004-1060)TCP Connection Reset Vulnerability:
A denial of service vulnerability allows an attacker to send a specially crafted TCP message to an affected system. An attacker who successfully exploits this vulnerability could cause the affected system to reset existing TCP connections. (CAN-2004-0230)Spoofed Connection Request Vulnerability:
A denial of service vulnerability allows an attacker to send a specially crafted TCP/IP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding. (CAN-2005-0688)Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for Embedded (KB893066)
April Security Updates for Embedded (KB893066)
- Consequence
- An attacker who successfully exploits the most severe of these vulnerabilities could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts with full user rights. An attacker who successfully exploits the most severe of these vulnerabilities would most likely cause the affected system to stop responding.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=FCDF84FF-AE44-4EB1-A58C-12D5D122FC95Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=81049A86-6F39-4A27-A643-391262785CF3Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
http://www.microsoft.com/downloads/details.aspx?FamilyId=98D7C0DA-EA4D-4095-9047-C0086D0D29A8Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
http://www.microsoft.com/downloads/details.aspx?FamilyId=AC019224-82BE-4263-B977-02D4DC6C9FF6Microsoft Windows Server 2003 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=F1F9A44F-D4F1-4EF8-83F7-737DF6CC292EMicrosoft Windows Server 2003 for Itanium based Systems :
http://www.microsoft.com/downloads/details.aspx?FamilyId=AC019224-82BE-4263-B977-02D4DC6C9FF6Refer to Micrsoft Security Bulletin MS05-019 for further details.
-
Microsoft Internet Explorer Multiple Vulnerabilities (MS05-020)
- Severity
- Urgent 5
- Qualys ID
- 100025
- Vendor Reference
- MS05-020
- CVE Reference
- CVE-2005-0553, CVE-2005-0554, CVE-2005-0555
- CVSS Scores
- Base 7.5 / Temporal 6.2
- Description
-
Microsoft Security Update MS05-020 is not installed on the target. This update fixes the issues described below.
DHTML Object Memory Corruption Vulnerability:
A remote code execution vulnerability exists in Internet Explorer because of the way that it handles certain DHTML objects. An attacker could exploit the vulnerability by constructing a malicious Web page. This malicious Web page could allow remote code execution if a user visits a malicious Web site. An attacker who successfully exploits this vulnerability could take complete control of an affected system. (CAN-2005-0553)URL Parsing Memory Corruption Vulnerability:
A remote code execution vulnerability exists in Internet Explorer because of the way that it handles certain URLs. An attacker could exploit the vulnerability by constructing a malicious Web page. This malicious Web page could potentially allow remote code execution if a user visits a malicious Web site. An attacker who successfully exploits this vulnerability could take complete control of an affected system. (CAN-2005-0554)Content Advisor Memory Corruption Vulnerability:
A remote code execution vulnerability exists in Internet Explorer because of the way that it handles Content Advisor files. An attacker could exploit the vulnerability by constructing a specially crafted Content Advisor file. This malicious Content Advisor file could potentially allow remote code execution if a user visits a malicious Web site or views a malicious e-mail message and accepts the installation of the file. An attacker who successfully exploits this vulnerability could take complete control of an affected system. However, significant user interaction is required to exploit this vulnerability. (CAN-2005-0555)Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
April Security Updates for Embedded (KB890923)
- Consequence
-
An attacker who successfully exploits any of these vulnerabilities could take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Internet Explorer 5.01 Service Pack 3 on Microsoft Windows 2000 Service Pack 3: :
http://www.microsoft.com/downloads/details.aspx?FamilyId=6CF45449-03D8-40B8-A4C0-09F413EE8EABInternet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4: :
http://www.microsoft.com/downloads/details.aspx?FamilyId=627F8991-7717-4ADE-A5AE-169591B6AAE0Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows XP Service Pack 1: :
http://www.microsoft.com/downloads/details.aspx?FamilyId=92E5A83D-9131-4B20-915A-A444C51656DCInternet Explorer 6 Service Pack 1 for Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium): :
http://www.microsoft.com/downloads/details.aspx?FamilyId=87241BC0-E1E9-4EFC-A6EC-5413119D3100Internet Explorer 6 for Microsoft Windows Server 2003: :
http://www.microsoft.com/downloads/details.aspx?FamilyId=88879B7A-3F4D-40D4-ADFD-4BBD8D4D865FInternet Explorer 6 for Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium): :
http://www.microsoft.com/downloads/details.aspx?FamilyId=FF80E80F-862A-4484-BC9D-FE05F966F1F4Internet Explorer 6 for Microsoft Windows XP Service Pack 2: :
http://www.microsoft.com/downloads/details.aspx?FamilyId=974F9611-6352-4F9C-B258-346C317857C5Refer to Micrsoft Security Bulletin MS05-020 for further details.
-
Microsoft Exchange Server Remote Code Execution (MS05-021)
- Severity
- Urgent 5
- Qualys ID
- 90241
- Vendor Reference
- MS05-021
- CVE Reference
- CVE-2005-0560
- CVSS Scores
- Base 7.5 / Temporal 6.2
- Description
- A remote code execution vulnerability exists in Microsoft Exchange Server. Exploitation of this issue could allow an attacker to connect to the SMTP port on an Exchange server and issue a specially-crafted command. This could result in a denial of service or allow an attacker to run malicious programs of their choice in the security context of the SMTP service.
- Consequence
- An attacker who successfully exploits this vulnerability could remotely take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts with full system rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Exchange 2000 Server Service Pack 3 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=2A2AF17E-2E4A-4479-8AC9-B5544EA0BD66Microsoft Exchange Server 2003 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=97F409EB-C8D0-4C94-A67B-5945E26C9267Microsoft Exchange Server 2003 Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=35BCE74A-E84A-4035-BF18-196368F032CCRefer to Microsoft Security Bulletin MS05-021 for further details.
-
MSN Messenger Remote Code Excution (MS05-022)
- Severity
- Urgent 5
- Qualys ID
- 38419
- Vendor Reference
- MS05-022
- CVE Reference
- CVE-2005-0562
- CVSS Scores
- Base 7.5 / Temporal 5.5
- Description
- A remote code execution vulnerability exists in MSN Messenger.
- Consequence
- By successfully exploiting this vulnerability, an attacker could take complete control of the affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:MSN Messenger 6.2 :
http://go.microsoft.com/fwlink/?LinkId=100148Refer to Micrsoft Security Bulletin MS05-022 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.10.88-7. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110031
- 90242
- 90240
- 90243
- 90244
- 100025
- 90241
- 38419
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.