Microsoft security alert.
January 9, 2007
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 10 vulnerabilities that were fixed in 4 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 4 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Office 2003 Brazilian Portuguese Grammar Checker Remote Code Execution Vulnerability (MS07-001)
- Severity
- Urgent 5
- Qualys ID
- 110051
- Vendor Reference
- MS07-001
- CVE Reference
- CVE-2006-5574
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
- Microsoft Office 2003 Brazilian Portuguese Grammar Checker is vulnerable to a remote code execution issue.
- Consequence
- If this vulnerability is successfully exploited, a remote attacker could gain complete control of a vulnerable machine. The attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2003 Service Pack 2 (Brazilian Portuguese Version) :
http://www.microsoft.com/downloads/details.aspx?familyid=B828BA91-A993-41EC-839C-8995CCFAEC6BMicrosoft Office Multilingual User Interface 2003 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?familyid=C860DE66-DB1A-489D-8518-42CE468F5965Microsoft Project Multilingual User Interface 2003 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?familyid=8F233E5D-1270-4041-9CDD-C3541B7F4B40Microsoft Visio Multilingual User Interface 2003 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?familyid=C5A29C81-419C-440B-BF0B-FEC0C0708430Microsoft Office Proofing Tools 2003 Service Pack 2 :
http://www.microsoft.com/downloads/details.aspx?familyid=51E9C97A-C35F-45AD-A587-8F08F1D34B7BRefer to Microsoft Security Bulletin MS07-001 for further details.
-
Microsoft Excel Remote Code Execution Vulnerabilities (MS07-002)
- Severity
- Critical 4
- Qualys ID
- 110050
- Vendor Reference
- MS07-002
- CVE Reference
- CVE-2007-0027, CVE-2007-0028, CVE-2007-0029, CVE-2007-0030, CVE-2007-0031
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Excel is exposed to multiple remote code execution vulnerabilities as described below.
- Excel Malformed IMDATA Record Vulnerability - CVE-2007-0027
- Excel Malformed Record Vulnerability - CVE-2007-0028
- Excel Malformed String Vulnerability - CVE-2007-0029
- Excel Malformed Column Record Vulnerability - CVE-2007-0030
- Excel Malformed Palette Record Vulnerability - CVE-2007-0031
- Consequence
- If a user is logged on with administrative user rights, an attacker who successfully exploits one of the above issues could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3 (Microsoft Excel 2000 ):
http://www.microsoft.com/downloads/details.aspx?familyid=5CCF4455-6B22-4249-93D7-661D12839292Microsoft Office XP Service Pack 3 (Microsoft Excel 2002 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE7278EA-3AEE-4994-9657-66019961D63CMicrosoft Office 2003 Service Pack 2 (Microsoft Excel 2003 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=79B88CE8-5C56-462F-AC1A-4BCE04C8F543Microsoft Office 2003 Service Pack 2 (Microsoft Office Excel Viewer 2003 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=99AE7653-F0FD-4DBA-A151-098FD03E6EA4Microsoft Works Suites (Microsoft Works Suite 2004 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE7278EA-3AEE-4994-9657-66019961D63CMicrosoft Works Suites (Microsoft Works Suite 2005 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=EE7278EA-3AEE-4994-9657-66019961D63CMicrosoft Office 2004 for Mac :
http://www.microsoft.com/mac/Microsoft Office v. X for Mac :
http://www.microsoft.com/mac/Refer to Micrsoft Security Bulletin MS07-002 for further details.
-
Microsoft Outlook Remote Code Execution Vulnerabilities (MS07-003)
- Severity
- Critical 4
- Qualys ID
- 110049
- Vendor Reference
- MS07-003
- CVE Reference
- CVE-2006-1305, CVE-2007-0033, CVE-2007-0034
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Microsoft udpate MS07-003 resolves several newly discovered vulnerabilities in Microsoft Outlook.
The following specific issues were reported:
- A remote code execution when Outlook parses a file and processes a malformed VEVENT record.
- A denial of service when processing a malformed e-mail.
- A remote code execution when Outlook parses an .oss file. - Consequence
- As a result, an attacker could take complete control of the target host if the user is logged in to a vulnerable version of Microsoft Outlook with administrative rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3 (Microsoft Outlook 2000 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=97CE0B32-C6AF-4C6C-ABF1-838ED89062EBMicrosoft Office XP Service Pack 3 (Microsoft Outlook 2002 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=1D1991C5-3DE3-4258-9120-058FFD62B4F5Microsoft Office 2003 Service Pack 2 (Microsoft Outlook 2003 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=9E4DD8AE-2564-4176-AC2E-E3760058CB56Refer to Micrsoft Security Bulletin MS07-003 for further details.
-
Microsoft Windows Vector Markup Language Remote Code Execution Vulnerability (MS07-004)
- Severity
- Urgent 5
- Qualys ID
- 90377
- Vendor Reference
- MS07-004
- CVE Reference
- CVE-2007-0024
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
A remote code execution vulnerability exists in the Vector Markup Language (VML) implementation in Microsoft Windows.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
February 2007 Windows XP Embedded Updates Now Available on the ECE (KB929969)
- Consequence
- An attacker who successfully exploits this vulnerability could take complete control of an affected system. The exploit is posted here.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows XP Service Pack 2 :
http://www.microsoft.com/download/details.aspx?FamilyId=81FB6A72-AC8A-4B28-905F-A44691D69432Microsoft Windows XP Professional x64 Edition :
http://www.microsoft.com/download/details.aspx?FamilyId=D06FD167-4F3E-4A2C-B52C-7426DDAD6828Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
http://www.microsoft.com/download/details.aspx?FamilyId=4FEE481F-DACE-4EAC-9AFE-BC28ADD70CC5Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
http://www.microsoft.com/download/details.aspx?FamilyId=C517FB85-128E-43DB-A659-38AF32283716Microsoft Windows Server 2003 x64 Edition :
http://www.microsoft.com/download/details.aspx?FamilyId=FF4A1F24-C1E9-4223-965B-14C4793AAF96Refer to Micrsoft Security Bulletin MS07-004 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.16.48-5. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110051
- 110050
- 110049
- 90377
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.