Microsoft security alert.
May 13, 2008
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 7 vulnerabilities that were fixed in 4 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 4 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Word Remote Code Execution Vulnerability (MS08-026)
- Severity
- Urgent 5
- Qualys ID
- 110080
- Vendor Reference
- MS08-026
- CVE Reference
- CVE-2008-1091, CVE-2008-1434
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
- Microsoft Word is susceptible to a remote code execution issue if a user opens a specially-crafted Word file.
- Consequence
- If a user opens a specially-crafted Word file, then an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3 (Microsoft Word 2000 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=9215ff71-38c0-416a-b89a-fe3474160f41Microsoft Office XP Service Pack 3 (Microsoft Word 2002 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=b348a518-221e-4567-a797-999715a8b2efMicrosoft Office 2003 Service Pack 2 (Microsoft Word 2003 Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=bc33d144-f917-47b8-961f-744ca847e14cMicrosoft Office 2003 Service Pack 3 (Microsoft Word 2003 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=bc33d144-f917-47b8-961f-744ca847e14c2007 Microsoft Office System (Microsoft Word 2007):
http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e2550Microsoft Outlook 2007:
http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e25502007 Microsoft Office System Service Pack 1 (Microsoft Word 2007 Service Pack 1):
http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e2550Microsoft Outlook 2007 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e2550Microsoft Word Viewer 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=bce7ea31-2bf0-4930-aff9-837bcc82a682Microsoft Word Viewer 2003 Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=bce7ea31-2bf0-4930-aff9-837bcc82a682Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2d718f37-c5d1-4e15-a7e1-5a15fedef52fMicrosoft Office 2004 for Mac:
http://www.microsoft.com/downloads/details.aspx?FamilyId=99F54471-CCF9-4D94-A882-A05ECD128ADCFor a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-026.
-
Microsoft Office Publisher Remote Code Execution Vulnerability (MS08-027)
- Severity
- Urgent 5
- Qualys ID
- 110079
- Vendor Reference
- MS08-027
- CVE Reference
- CVE-2008-0119
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
- Microsoft Office Publisher is susceptible to remote code execution due to the way it validates object header data when parsing a specially-crafted Publisher file.
- Consequence
- If a user opens a specially-crafted Publisher file, then an attacker could take complete control of the affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3 (Microsoft Office Publisher 2000 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=8675b9b6-fbf0-4ad2-9210-285e2cc10556Microsoft Office XP Service Pack 3 (Microsoft Office Publisher 2002 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=df623784-6e26-42c0-9e21-e7960b849e1eMicrosoft Office 2003 Service Pack 2 (Microsoft Office Publisher 2003 Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=c18b060b-9828-4952-8e80-5328c0832d83Microsoft Office 2003 Service Pack 3 (Microsoft Office Publisher 2003 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=c18b060b-9828-4952-8e80-5328c0832d832007 Microsoft Office System (Microsoft Office Publisher 2007):
http://www.microsoft.com/downloads/details.aspx?FamilyId=e4b647c2-79a3-49e0-9b1d-741667fdbcca2007 Microsoft Office System Service Pack 1 (Microsoft Office Publisher 2007 Service Pack 1):
http://www.microsoft.com/downloads/details.aspx?FamilyId=e4b647c2-79a3-49e0-9b1d-741667fdbccaRefer to Microsoft Security Bulletin MS08-027 for further details.
-
Microsoft Jet Database Engine Remote Code Execution Vulnerability (MS08-028)
- Severity
- Urgent 5
- Qualys ID
- 90437
- Vendor Reference
- MS08-028
- CVE Reference
- CVE-2005-0944, CVE-2007-6026
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Jet DataBase Engine is prone to a buffer overflow vulnerability because it fails to properly bounds-check user-supplied data.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June 2008 Security Updates are Now Available (KB950749)
May Security Updates for DQI available (KB950749)
- Consequence
- Remote exploitation of this issue may allow attackers to execute arbitrary machine code in the context of a user running the application. Successful exploitation will compromise the affected application and possibly the underlying computer. Failed attacks will likely cause a denial of service condition.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (Microsoft Jet 4.0 Database Engine):
http://www.microsoft.com/downloads/details.aspx?familyid=0de12d09-e675-4cf0-bc6f-e42eeb4784a1Windows XP Service Pack 2 (Microsoft Jet 4.0 Database Engine):
http://www.microsoft.com/downloads/details.aspx?familyid=3247433f-0aa9-49b8-9e40-c5463a95bcffWindows XP Professional x64 Edition (Microsoft Jet 4.0 Database Engine):
http://www.microsoft.com/downloads/details.aspx?familyid=4915ebc4-5e7b-493e-b8c4-321d40d9a701Windows Server 2003 Service Pack 1 (Microsoft Jet 4.0 Database Engine):
http://www.microsoft.com/downloads/details.aspx?familyid=86e3ed62-98f7-46ec-96ab-5e8c123b1288Windows Server 2003 x64 Edition (Microsoft Jet 4.0 Database Engine):
http://www.microsoft.com/downloads/details.aspx?familyid=5dfc867b-74b7-4818-9fc2-d71e7c9d2e38Windows Server 2003 with SP1 for Itanium-based Systems (Microsoft Jet 4.0 Database Engine):
http://www.microsoft.com/downloads/details.aspx?familyid=3452119b-ba4c-4272-82ec-97396b2c2c3dRefer to Micrsoft Security Bulletin MS08-028 for further details.
-
Microsoft Malware Protection Engine Denial of Service Vulnerabilities (MS08-029)
- Severity
- Serious 3
- Qualys ID
- 90436
- Vendor Reference
- MS08-029
- CVE Reference
- CVE-2008-1437, CVE-2008-1438
- CVSS Scores
- Base 5 / Temporal 4.1
- Description
-
Microsoft Security Bulletin MS08-029 resolves 2 privately reported vulnerabilities in the Microsoft Malware Protection Engine. An attacker could exploit these vulnerabilities by constructing a specially-crafted file which when received by the target computer system and scanned by the Microsoft Malware Protection Engine may result in a denial of service condition.
This security update is rated Moderate for the following: Windows Live OneCare, Microsoft Antigen for Exchange, Microsoft Antigen for SMTP Gateway, Microsoft Windows Defender, Microsoft Forefront Client Security, Microsoft Forefront Security for Exchange Server and Microsoft Forefront Security for SharePoint.
This security update is rated Low for the following: Standalone System Sweeper located in Diagnostics and Recovery Toolset 6.
- Consequence
- A denial of service condition may result, causing the Microsoft Malware Protection Engine to stop responding and automatically restart.
- Solution
-
This security update addresses the vulnerability by modifying the way that the Malware Protection Engine processes files. Refer to Microsoft Security Bulletin MS08-029 for further information.
Microsoft has rated this issue as Moderate.
Additional Reference Links:
http://marc.info/?l=bugtraq&m=121129490723574&w=2
http://www.us-cert.gov/cas/techalerts/TA08-134A.html
http://www.securityfocus.com/bid/29060
http://www.securityfocus.com/bid/29073
http://secunia.com/advisories/30172
http://www.frsirt.com/english/advisories/2008/1506/references
http://www.securitytracker.com/id?1020016
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS08-029 Windows
MS08-029 Windows
These new vulnerability checks are included in Qualys vulnerability signature 1.19.138-5. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110080
- 110079
- 90437
- 90436
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.