Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 7 vulnerabilities that were fixed in 4 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 4 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Word Remote Code Execution Vulnerability (MS08-026)

  Severity

  Urgent 5

  Qualys ID

  110080

  Vendor Reference

  MS08-026

  CVE Reference

  CVE-2008-1091, CVE-2008-1434

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Microsoft Word is susceptible to a remote code execution issue if a user opens a specially-crafted Word file.

  Consequence

  If a user opens a specially-crafted Word file, then an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2000 Service Pack 3 (Microsoft Word 2000 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9215ff71-38c0-416a-b89a-fe3474160f41

  Microsoft Office XP Service Pack 3 (Microsoft Word 2002 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=b348a518-221e-4567-a797-999715a8b2ef

  Microsoft Office 2003 Service Pack 2 (Microsoft Word 2003 Service Pack 2):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=bc33d144-f917-47b8-961f-744ca847e14c

  Microsoft Office 2003 Service Pack 3 (Microsoft Word 2003 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=bc33d144-f917-47b8-961f-744ca847e14c

  2007 Microsoft Office System (Microsoft Word 2007):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e2550

  Microsoft Outlook 2007:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e2550

  2007 Microsoft Office System Service Pack 1 (Microsoft Word 2007 Service Pack 1):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e2550

  Microsoft Outlook 2007 Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=071ceaa2-12e3-4401-9331-2a54a93e2550

  Microsoft Word Viewer 2003:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=bce7ea31-2bf0-4930-aff9-837bcc82a682

  Microsoft Word Viewer 2003 Service Pack 3:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=bce7ea31-2bf0-4930-aff9-837bcc82a682

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2d718f37-c5d1-4e15-a7e1-5a15fedef52f

  Microsoft Office 2004 for Mac:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=99F54471-CCF9-4D94-A882-A05ECD128ADC

  For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-026.

• Microsoft Office Publisher Remote Code Execution Vulnerability (MS08-027)

  Severity

  Urgent 5

  Qualys ID

  110079

  Vendor Reference

  MS08-027

  CVE Reference

  CVE-2008-0119

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft Office Publisher is susceptible to remote code execution due to the way it validates object header data when parsing a specially-crafted Publisher file.

  Consequence

  If a user opens a specially-crafted Publisher file, then an attacker could take complete control of the affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2000 Service Pack 3 (Microsoft Office Publisher 2000 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8675b9b6-fbf0-4ad2-9210-285e2cc10556

  Microsoft Office XP Service Pack 3 (Microsoft Office Publisher 2002 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=df623784-6e26-42c0-9e21-e7960b849e1e

  Microsoft Office 2003 Service Pack 2 (Microsoft Office Publisher 2003 Service Pack 2):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=c18b060b-9828-4952-8e80-5328c0832d83

  Microsoft Office 2003 Service Pack 3 (Microsoft Office Publisher 2003 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=c18b060b-9828-4952-8e80-5328c0832d83

  2007 Microsoft Office System (Microsoft Office Publisher 2007):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=e4b647c2-79a3-49e0-9b1d-741667fdbcca

  2007 Microsoft Office System Service Pack 1 (Microsoft Office Publisher 2007 Service Pack 1):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=e4b647c2-79a3-49e0-9b1d-741667fdbcca

  Refer to Microsoft Security Bulletin MS08-027 for further details.

• Microsoft Jet Database Engine Remote Code Execution Vulnerability (MS08-028)

  Severity

  Urgent 5

  Qualys ID

  90437

  Vendor Reference

  MS08-028

  CVE Reference

  CVE-2005-0944, CVE-2007-6026

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Jet DataBase Engine is prone to a buffer overflow vulnerability because it fails to properly bounds-check user-supplied data.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  June 2008 Security Updates are Now Available (KB950749)
  May Security Updates for DQI available (KB950749)
  

  Consequence

  Remote exploitation of this issue may allow attackers to execute arbitrary machine code in the context of a user running the application. Successful exploitation will compromise the affected application and possibly the underlying computer. Failed attacks will likely cause a denial of service condition.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 (Microsoft Jet 4.0 Database Engine):
  http://www.microsoft.com/downloads/details.aspx?familyid=0de12d09-e675-4cf0-bc6f-e42eeb4784a1

  Windows XP Service Pack 2 (Microsoft Jet 4.0 Database Engine):
  http://www.microsoft.com/downloads/details.aspx?familyid=3247433f-0aa9-49b8-9e40-c5463a95bcff

  Windows XP Professional x64 Edition (Microsoft Jet 4.0 Database Engine):
  http://www.microsoft.com/downloads/details.aspx?familyid=4915ebc4-5e7b-493e-b8c4-321d40d9a701

  Windows Server 2003 Service Pack 1 (Microsoft Jet 4.0 Database Engine):
  http://www.microsoft.com/downloads/details.aspx?familyid=86e3ed62-98f7-46ec-96ab-5e8c123b1288

  Windows Server 2003 x64 Edition (Microsoft Jet 4.0 Database Engine):
  http://www.microsoft.com/downloads/details.aspx?familyid=5dfc867b-74b7-4818-9fc2-d71e7c9d2e38

  Windows Server 2003 with SP1 for Itanium-based Systems (Microsoft Jet 4.0 Database Engine):
  http://www.microsoft.com/downloads/details.aspx?familyid=3452119b-ba4c-4272-82ec-97396b2c2c3d

  Refer to Micrsoft Security Bulletin MS08-028 for further details.

• Microsoft Malware Protection Engine Denial of Service Vulnerabilities (MS08-029)

  Severity

  Serious 3

  Qualys ID

  90436

  Vendor Reference

  MS08-029

  CVE Reference

  CVE-2008-1437, CVE-2008-1438

  CVSS Scores

  Base 5 / Temporal 4.1

  Description

  Microsoft Security Bulletin MS08-029 resolves 2 privately reported vulnerabilities in the Microsoft Malware Protection Engine. An attacker could exploit these vulnerabilities by constructing a specially-crafted file which when received by the target computer system and scanned by the Microsoft Malware Protection Engine may result in a denial of service condition.

  This security update is rated Moderate for the following: Windows Live OneCare, Microsoft Antigen for Exchange, Microsoft Antigen for SMTP Gateway, Microsoft Windows Defender, Microsoft Forefront Client Security, Microsoft Forefront Security for Exchange Server and Microsoft Forefront Security for SharePoint.

  This security update is rated Low for the following: Standalone System Sweeper located in Diagnostics and Recovery Toolset 6.

  Consequence

  A denial of service condition may result, causing the Microsoft Malware Protection Engine to stop responding and automatically restart.

  Solution

  This security update addresses the vulnerability by modifying the way that the Malware Protection Engine processes files. Refer to Microsoft Security Bulletin MS08-029 for further information.

  Microsoft has rated this issue as Moderate.

  Additional Reference Links:

  http://marc.info/?l=bugtraq&m=121129490723574&w=2
  http://www.us-cert.gov/cas/techalerts/TA08-134A.html
  http://www.securityfocus.com/bid/29060
  http://www.securityfocus.com/bid/29073
  http://secunia.com/advisories/30172
  http://www.frsirt.com/english/advisories/2008/1506/references
  http://www.securitytracker.com/id?1020016
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS08-029 Windows
  MS08-029 Windows

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.