Microsoft security alert.
April 11, 2006
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 15 vulnerabilities that were fixed in 5 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 5 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Internet Explorer Cumulative Security Update Missing (MS06-013)
- Severity
- Urgent 5
- Qualys ID
- 100034
- Vendor Reference
- MS06-013
- CVE Reference
- CVE-2006-1185, CVE-2006-1186, CVE-2006-1188, CVE-2006-1189, CVE-2006-1190, CVE-2006-1191, CVE-2006-1192, CVE-2006-1245, CVE-2006-1359, CVE-2006-1388
- CVSS Scores
- Base 10 / Temporal 8.7
- Description
-
Multiple vulnerabilities have been found in Internet Explorer that can be exploited by visiting malicious Web sites, including:
- DHTML Method Call Memory Corruption Vulnerability
- Multiple Event Handler Memory Corruption Vulnerability
- HTA Execution Vulnerability
- HTML Parsing Vulnerability
- COM Object Instantiation Memory Corruption Vulnerability
- HTML Tag Memory Corruption Vulnerability
- Double-Byte Character Parsing Memory Corruption Vulnerability
- Script Execution Vulnerability
- Cross-Domain Information Disclosure Vulnerability
- Address Bar Spoofing VulnerabilityDetails of individual vulnerabilities may be found in the referenced advisory.
- Consequence
- If a user is logged on with administrative user rights, an attacker who successfully exploits the most severe of these vulnerabilities could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; and create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=594E7B87-AF8F-4346-9164-596E3E5C22B1Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 or on Microsoft Windows XP Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=033C41E1-2B36-4696-987A-099FC57E0129Internet Explorer 6 for Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=F05FFB31-E6B4-4771-81F1-4ACCEBF72133Internet Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE566871-D217-41D3-BECC-B27FAFA00054Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
http://www.microsoft.com/downloads/details.aspx?FamilyId=E584957C-0ABE-4129-ABAF-AA2852AD62A3Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition :
http://www.microsoft.com/downloads/details.aspx?FamilyId=5A1C8BE3-39EE-4937-9BD1-280FC35125C6Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition :
http://www.microsoft.com/downloads/details.aspx?FamilyId=C278FE3E-620A-4BBC-868B-CA2D9EFF7AC3Refer to Micrsoft Security Bulletin MS06-013 for further details.
-
Microsoft Data Access Components (MDAC) Function Could Allow Code Execution (MS06-014)
- Severity
- Serious 3
- Qualys ID
- 90306
- Vendor Reference
- MS06-014
- CVE Reference
- CVE-2006-0003
- CVSS Scores
- Base 5.1 / Temporal 4.4
- Description
- A remote code execution vulnerability exists in the RDS.Dataspace ActiveX control that is provided as part of the ActiveX Data Objects (ADO) and that is distributed in Microsoft Data Access Components (MDAC). An attacker who successfully exploits this vulnerability could take complete control of an affected system.
- Consequence
- If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of the affected system. The attacker could then install programs; view, change, or delete data; and create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows XP Service Pack 1 running Microsoft Data Access Components 2.7 Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=2F9E772C-8122-4027-A117-E93227B2C79FMicrosoft Windows XP Service Pack 2 running Microsoft Data Access Components 2.8 Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=2F9E772C-8122-4027-A117-E93227B2C79FMicrosoft Windows XP Professional x64 Edition running Microsoft Data Access Components 2.8 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9C8B645D-0F01-4B79-B6B3-55279BEDB944Microsoft Windows Server 2003 running Microsoft Data Access Components 2.8 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=39B29ED4-9B95-4593-BCB6-4BB03CA5F8F1Microsoft Windows Server 2003 Service Pack 1 running Microsoft Data Access Components 2.8 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=39B29ED4-9B95-4593-BCB6-4BB03CA5F8F1Microsoft Windows Server 2003 for Itanium based Systems running Microsoft Data Access Components 2.8 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=4D2FE426-E34E-4192-8A0F-35E440E948E2Microsoft Windows Server 2003 with SP1 for Itanium based Systems running Microsoft Data Access Components 2.8 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=4D2FE426-E34E-4192-8A0F-35E440E948E2Microsoft Windows Server 2003 x64 Edition running Microsoft Data Access Components 2.8 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=E237C2C7-9819-437B-AB70-298BA62AC285Windows 2000 Service Pack 4 with Microsoft Data Access Components 2.5 Service Pack 3 installed :
http://www.microsoft.com/downloads/details.aspx?FamilyId=1B3E6CB9-1EF2-4BA1-A2F2-F87B717372FBWindows 2000 Service Pack 4 with Microsoft Data Access Components 2.7 Service Pack 1 installed :
http://www.microsoft.com/downloads/details.aspx?FamilyId=0AA7C8B7-8417-42D8-8E73-5466C03B8C65For a complete list of patch download links, please refer to Microsoft Security Bulletin MS06-014.
-
Microsoft Windows Explorer Remote Code Execution Vulnerability (MS06-015)
- Severity
- Urgent 5
- Qualys ID
- 90305
- Vendor Reference
- MS06-015
- CVE Reference
- CVE-2004-2289, CVE-2006-0012
- CVSS Scores
- Base 10 / Temporal 7.8
- Description
- A remote code execution vulnerability exists in Windows Explorer because of the way that it handles COM objects. To exploit this vulnerability, an attacker would need to convince a user to visit a Web site that could force a connection to a remote file server. This remote file server could then cause Windows Explorer to fail in a way that would allow code execution. An attacker who successfully exploits this vulnerability could take complete control of an affected system.
- Consequence
- If successfully exploited, a remote attacker could take complete control of the affected system. The attacker could then install programs; view, change, or delete data; and create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=AE28BC65-3A5E-4497-AD05-2CDE8E7B5E95Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=392C2F1B-AA24-48E5-8D5B-EA56341DB936Microsoft Windows XP Professional x64 Edition :
http://www.microsoft.com/downloads/details.aspx?FamilyId=11A5195E-3F32-41F9-AB39-68A099EE945DMicrosoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=099EE535-8B31-4356-B3FB-EF524C20A424Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
http://www.microsoft.com/downloads/details.aspx?FamilyId=E3C7E736-1583-4BD5-B661-A9AADDFA5B86Microsoft Windows Server 2003 x64 Edition :
http://www.microsoft.com/downloads/details.aspx?FamilyId=238AB809-5A7E-4678-B01B-38FD82E9C701Refer to Microsoft Security Bulletin MS06-015 for further details.
-
Microsoft Outlook Express Cumulative Security Update Missing (MS06-016)
- Severity
- Critical 4
- Qualys ID
- 90307
- Vendor Reference
- MS06-016
- CVE Reference
- CVE-2006-0014
- CVSS Scores
- Base 5.1 / Temporal 3.8
- Description
- A remote code execution vulnerability exists in Outlook Express when using a Windows Address Book (.wab) file. Microsoft has rated this update as important.
- Consequence
- If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of the affected system. The attacker could then install programs; view, change, or delete data; and create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Outlook Express 6 on Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=484DE679-5505-4196-BDD8-F7CF325AF0F5Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition :
http://www.microsoft.com/downloads/details.aspx?FamilyId=A7B10D8F-D9D7-4423-AA6D-C1C41D23794EOutlook Express 6 Microsoft Windows Server 2003 on Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
http://www.microsoft.com/downloads/details.aspx?familyid=800BF687-BEE5-478F-A025-43CD16682F31Outlook Express 6 on Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=0DD827BC-6FA1-405A-933E-FB422A4E8096Outlook Express 6 on Microsoft Windows XP Professional x64 Edition :
http://www.microsoft.com/downloads/details.aspx?familyid=FF772C0B-6F98-449D-B02E-C9C236068172Outlook Express 6 Service Pack 1 on Microsoft Windows XP Service Pack 1 or when installed on Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=CDA93501-99CB-4F28-BB73-6438CAD081DBOutlook Express 5.5 Service Pack 2 on Microsoft Windows 2000 Service Pack 4 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=E61A3D64-14FD-4976-BB03-C31CA6EE61E2Refer to Microsoft Security Bulletin MS06-016 for further details.
-
FrontPage Server Extensions Cross-Site Scripting Vulnerability (MS06-017)
- Severity
- Serious 3
- Qualys ID
- 86739
- Vendor Reference
- MS06-017
- CVE Reference
- CVE-2006-0015
- CVSS Scores
- Base 6.8 / Temporal 5.3
- Description
-
FrontPage Server Extensions is a set of tools that can be installed on a Web site. The tools allow authorized personnel to manage the server, add or change content, and perform other tasks.
A cross-site scripting vulnerability exists that could allow an attacker to convince a user to run a malicious client-side script on behalf of a FrontPage Server Extensions user.
QID Detection Logic (Authenticated):
Operating System: Windows
The QID checks the version of the file "fpadmdll.dll" (for FrontPage Server Extension 2002).QID Detection Logic (Unauthenticated):
The QID sends a GET /_vti_inf.html request to retrieve the version of FrontPage Server Extension running on the Host. - Consequence
- An attacker who successfully exploits this vulnerability could gain the same rights as the user's rights on the FrontPage Server Extensions 2002 or SharePoint Team Services 2002 server.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft FrontPage Server Extensions 2002 shipped on Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=5C03F85A-5228-47FB-A338-90FA23818E08Microsoft FrontPage Server Extensions 2002 shipped on Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
http://www.microsoft.com/downloads/details.aspx?FamilyID=59f15a6b-cc1b-43d5-a007-bfc9abb63486Microsoft FrontPage Server Extensions 2002 (x64 Edition) downloaded and installed on Microsoft Windows Server 2003 x64 Edition and Microsoft Windows XP Professional x64 Edition :
http://www.microsoft.com/downloads/details.aspx?FamilyId=F453530D-7063-49AB-B304-9C455DE6D8DAMicrosoft FrontPage Server Extensions 2002 (x86 Editions) downloaded and installed on Microsoft Windows Server 2000 Service Pack 4, Microsoft Windows XP Service Pack 1, and Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?FamilyId=F453530D-7063-49AB-B304-9C455DE6D8DAMicrosoft SharePoint Team Services :
http://www.microsoft.com/downloads/details.aspx?FamilyId=EEE40662-39E6-4C07-8241-1AC4F5D24FFCRefer to Microsoft Security Bulletin MS06-017 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.14.18-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100034
- 90306
- 90305
- 90307
- 86739
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.