Microsoft security alert.
August 12, 2008
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 26 vulnerabilities that were fixed in 11 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 11 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Access Snapshot Viewer ActiveX Control Vulnerability (MS08-041)
- Severity
- Urgent 5
- Qualys ID
- 110081
- Vendor Reference
- MS08-041
- CVE Reference
- CVE-2008-2463
- CVSS Scores
- Base 6.8 / Temporal 5.9
- Description
-
This security update resolves a privately reported vulnerability in the ActiveX control for the Snapshot Viewer for Microsoft Access. This issue is caused by a design error in the "snapview.ocx" ActiveX control that does not restrict access to certain methods and allows files to be automatically downloaded to arbitrary locations on a user's system.
Affected products:
Snapshot Viewer for Microsoft Access
Microsoft Office Access 2000
Microsoft Office Access 2002
Microsoft Office Access 2003 - Consequence
-
An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.
Note: The vulnerability is currently being actively exploited.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Snapshot Viewer for Microsoft Access:
http://www.microsoft.com/download/details.aspx?FamilyId=7C22BB32-7CE3-4FF2-8366-BA2EB5135833Microsoft Office 2000 Service Pack 3 (Microsoft Office Access 2000 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?familyid=54e4031d-298f-480c-88d5-0ad3b2b62ba9Microsoft Office XP Service Pack 3 (Microsoft Office Access 2002 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?familyid=34b655f8-1922-4246-94ca-ed381c3e3b13Microsoft Office 2003 Service Pack 2 and Microsoft Office 2003 Service Pack 3 (Microsoft Office Access 2003 Service Pack 2 and Microsoft Office Access 2003 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?familyid=fd698517-a504-427d-9e5f-fde8f102142cRefer to Micrsoft Security Bulletin MS08-041 for further details.
-
Microsoft Word Could Allow Remote Code Execution (MS08-042)
- Severity
- Critical 4
- Qualys ID
- 110082
- Vendor Reference
- MS08-042
- CVE Reference
- CVE-2008-2244
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Word versions 2002 and 2003 are vulnerable to a remote code execution issue when handling specially crafted Word files with a malformed record value.
Previously this was a Zero Day.
- Consequence
- If the vulnerability is successfully exploited, this could result in the execution of arbitrary code.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office XP Service Pack 3 (Microsoft Word 2002 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=c7146dfc-e1be-4d13-877b-1d9bcacc4a64Microsoft Office 2003 Service Pack 2 (Microsoft Word 2003 Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=13a37b76-9fec-426f-8176-3c95f934efe0Microsoft Office 2003 Service Pack 3 (Microsoft Word 2003 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=13a37b76-9fec-426f-8176-3c95f934efe0Refer to Micrsoft Security Bulletin MS08-042 for further details.
-
Microsoft Excel Could Allow Remote Code Execution (MS08-043)
- Severity
- Critical 4
- Qualys ID
- 110084
- Vendor Reference
- MS08-043
- CVE Reference
- CVE-2008-3003, CVE-2008-3004, CVE-2008-3005, CVE-2008-3006
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
Microsoft Excel is prone to multiple remote code execution vulnerabilities. The security update addresses the following issues:
- Excel Credential Caching Vulnerability (CVE-2008-3003)
- Excel Indexing Validation Vulnerability (CVE-2008-3004)
- Excel Index Array Vulnerability (CVE-2008-3005)
- Excel Record Parsing Vulnerability (CVE-2008-3006)
- Consequence
- An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3 (Excel 2000 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=4bf8688e-e5b9-4e53-a1a1-8cf1acfdb80bMicrosoft Office XP Service Pack 3 (Excel 2002 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=9BBF7550-F5C4-4B9B-BD86-1E7BE6C42EB5Microsoft Office 2003 Service Pack 2 (Excel 2003 Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=fc612e9a-bdf3-4952-8ada-0de5a50973f0Microsoft Office 2003 Service Pack 3 (Excel 2003 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=fc612e9a-bdf3-4952-8ada-0de5a50973f02007 Microsoft Office System (Excel 2007):
http://www.microsoft.com/downloads/details.aspx?FamilyId=2753e8d6-e156-49ef-af2d-4c521c808ffd2007 Microsoft Office System Service Pack 1 (Excel 2007 Service Pack 1):
http://www.microsoft.com/downloads/details.aspx?FamilyId=2753e8d6-e156-49ef-af2d-4c521c808ffdMicrosoft Office Excel Viewer 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=d7ed9e75-15f2-4950-98b3-93023ba0f4c1Microsoft Office Excel Viewer 2003 Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=d7ed9e75-15f2-4950-98b3-93023ba0f4c1Microsoft Office Excel Viewer:
http://www.microsoft.com/downloads/details.aspx?FamilyId=b574d906-7f09-49b0-80bf-e84dee8c4583Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7afdae9b-9c74-4af7-9844-0e54221ea3b9Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=7afdae9b-9c74-4af7-9844-0e54221ea3b9Microsoft Office SharePoint Server 2007:
http://www.microsoft.com/downloads/details.aspx?FamilyId=a7731749-b026-4765-808a-e151b990f0e1For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-043.
-
Microsoft Office Filters Could Allow Remote Code Execution (MS08-044)
- Severity
- Critical 4
- Qualys ID
- 110085
- Vendor Reference
- MS08-044
- CVE Reference
- CVE-2008-3018, CVE-2008-3019, CVE-2008-3020, CVE-2008-3021, CVE-2008-3460
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Office Filters contain the following vulnerabilities:
1) A remote code execution vulnerability exists in the way that a Microsoft Office filter handles a malformed graphics image. (CVE-2008-3019)
2) A remote code execution vulnerability exists in the way that Microsoft Office handles a PICT-format image file. (CVE-2008-3018 and CVE-2008-3021)
3) A remote code execution vulnerability exists in the way that Microsoft Office handles a BMP format image file. (CVE-2008-3020)
4) A remote code execution vulnerability exists in the way that Microsoft Office handles a WordPerfect Graphics (WPG) format image file. (CVE-2008-3460)
- Consequence
- An attacker who successfully exploits this vulnerability could take complete control of an affected system. Significant user interaction is required to exploit this vulnerability.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=3ab323ec-9f92-453c-b7c7-9a95a9efcaeaMicrosoft Office XP Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=bf566ce6-23da-45e5-9c2b-c47331d30e79Microsoft Office 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=e0df2f6e-1102-461d-829f-5f3e2d7eb4b3Microsoft Office Project 2002 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=bf566ce6-23da-45e5-9c2b-c47331d30e79Microsoft Office Converter Pack:
http://www.microsoft.com/downloads/details.aspx?familyid=199b08c7-6d79-4930-8f0c-31034629c485Microsoft Works 8:
http://www.microsoft.com/downloads/details.aspx?familyid=458985C3-9C6F-4049-81CD-0D0389C81F11Refer to Micrsoft Security Bulletin MS08-044 for further details.
-
Microsoft Internet Explorer Cumulative Security Update (MS08-045)
- Severity
- Critical 4
- Qualys ID
- 100059
- Vendor Reference
- MS08-045
- CVE Reference
- CVE-2008-2254, CVE-2008-2255, CVE-2008-2256, CVE-2008-2257, CVE-2008-2258, CVE-2008-2259
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
This critical security update resolves vulnerabilities existing in Microsoft Internet Explorer which are present due to HTML objects memory corruption, uninitialized memory corruption and HTML component handling.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2008 Updates are Available (including for XPe SP3 and Standard) (KB953838)
August 2008 Security Updates Are Now Available (KB953838)
- Consequence
- These vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (Microsoft Internet Explorer 5.01 Service Pack 4):
http://www.microsoft.com/downloads/details.aspx?familyid=1557B93B-ECBA-4F42-B89D-DB0EE067D65BMicrosoft Windows 2000 Service Pack 4 (Microsoft Internet Explorer 6 Service Pack 1):
http://www.microsoft.com/downloads/details.aspx?familyid=AA780735-5928-4C46-89A4-63A814954796Windows XP Service Pack 2 (Microsoft Internet Explorer 6):
http://www.microsoft.com/downloads/details.aspx?familyid=69AF2F30-138E-4B15-AB8D-4FCE44CC0BC2Windows XP Service Pack 3 (Microsoft Internet Explorer 6):
http://www.microsoft.com/downloads/details.aspx?familyid=69AF2F30-138E-4B15-AB8D-4FCE44CC0BC2Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Microsoft Internet Explorer 6):
http://www.microsoft.com/downloads/details.aspx?familyid=4780B89E-9735-4D3F-8DEF-34E7337FF604Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Microsoft Internet Explorer 6):
http://www.microsoft.com/downloads/details.aspx?familyid=0617A5DD-DCE9-4DE0-B0A0-CE38EFE13524Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Microsoft Internet Explorer 6):
http://www.microsoft.com/downloads/details.aspx?familyid=32A63F52-9FE6-48E3-BB4E-7D4DDA5E0A90Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft Internet Explorer 6):
http://www.microsoft.com/downloads/details.aspx?familyid=1855997E-A3BE-46B1-A0BC-BB55EB0045FEWindows XP Service Pack 2 and Windows XP Service Pack 3 (Windows Internet Explorer 7):
http://www.microsoft.com/downloads/details.aspx?familyid=8E2125C7-52CB-4052-82A3-2D3C6A953752Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Windows Internet Explorer 7):
http://www.microsoft.com/downloads/details.aspx?familyid=39B41E4B-3237-409D-A818-AB0517C5E7CFFor a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-045.
-
Microsoft Windows Image Color Management System Could Allow Remote Code Execution (MS08-046)
- Severity
- Critical 4
- Qualys ID
- 90450
- Vendor Reference
- MS08-046
- CVE Reference
- CVE-2008-2245
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
This update resolves a privately reported vulnerability in the Microsoft Image Color Management (ICM) system that could allow remote code execution in the context of the current user.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2008 Updates are Available (including for XPe SP3 and Standard) (KB952954)
August 2008 Security Updates Are Now Available (KB952954)
- Consequence
- If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?familyid=db455d17-435f-46d7-b2dd-5babb5a1eeb3Windows XP Service Pack 2 and Windows XP Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?familyid=d313f42c-f43f-48ea-82ef-3bc33077c7faWindows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=3150c6b8-f50b-4b84-a7ce-c8daf77c080cWindows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=828d8fdc-8534-4621-85a5-08aec255496fWindows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?familyid=0a13776f-d543-41df-b904-d51e368c81ccWindows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=9566493f-4260-4072-947a-527887d2cd63Refer to Micrsoft Security Bulletin MS08-046 for further details.
-
Microsoft IPsec Policy Processing Information Disclosure Vulnerability (MS08-047)
- Severity
- Serious 3
- Qualys ID
- 90447
- Vendor Reference
- MS08-047
- CVE Reference
- CVE-2008-2246
- CVSS Scores
- Base 7.8 / Temporal 6.1
- Description
- This security update resolves a vulnerability in the way certain Windows Internet Protocol Security (IPsec) rules are applied.
- Consequence
- An attacker who successfully exploits these vulnerabilities could cause systems to ignore IPsec policies and transmit network traffic in clear text, disclosing information intended to be encrypted on the network. An attacker viewing the traffic on the network would be able to view and possibly modify the contents of the traffic. Note that this vulnerability would not allow an attacker to execute code or to elevate their user rights directly. It could be used to collect useful information to try to further compromise the affected system(s) or network(s).
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Vista and Windows Vista Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=3f21a8a2-9861-4fef-9d1e-caf5f7822c1aWindows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=aa04a754-fbfb-42a7-89d2-14373e3f4742Windows Server 2008 for 32-bit Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=c3363df6-39dc-4910-9ce5-66553155378eWindows Server 2008 for x64-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=39dd1722-412b-469d-a475-b6513764838cWindows Server 2008 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=e9c6cd46-30ad-46ee-9c8b-d0b446e660c4Refer to Micrsoft Security Bulletin MS08-047 for further details.
-
Microsoft Outlook Express and Windows Mail Security Update (MS08-048)
- Severity
- Serious 3
- Qualys ID
- 90451
- Vendor Reference
- MS08-048
- CVE Reference
- CVE-2008-1448
- CVSS Scores
- Base 7.1 / Temporal 5.3
- Description
-
An information disclosure vulnerability exists in Outlook Express and Windows Mail because the MHTML protocol handler incorrectly interprets MHTML URL redirections that could potentially bypass Internet Explorer domain restrictions when returning MHTML content.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2008 Updates are Available (including for XPe SP3 and Standard) (KB951066)
August 2008 Security Updates Are Now Available (KB951066)
- Consequence
- An attacker who successfully exploits this vulnerability could read data from another Internet Explorer domain or the local computer.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 5.5 Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=6257bfae-35f0-4c0e-b960-bca7aa6f86f7Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 6 Service Pack 1):
http://www.microsoft.com/downloads/details.aspx?FamilyId=dab178f7-c282-41f4-acb1-a86e6aa4c91bWindows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Outlook Express 6 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91469f2f-461c-4a67-8738-d42520427f6bWindows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Microsoft Outlook Express 6 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=2220aece-79d2-426f-90ec-24a17470567aWindows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Microsoft Outlook Express 6):
http://www.microsoft.com/downloads/details.aspx?FamilyId=30f2244a-f6fd-4fc1-a871-abf6958cb660Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Microsoft Outlook Express 6):
http://www.microsoft.com/downloads/details.aspx?FamilyId=3287f006-cbb2-4c6d-820c-32833e08035aWindows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft Outlook Express 6):
http://www.microsoft.com/downloads/details.aspx?FamilyId=c8570e40-355b-4a9b-933d-53ae021cbda5Windows Vista and Windows Vista Service Pack 1 (Windows Mail):
http://www.microsoft.com/downloads/details.aspx?FamilyId=3851bcf8-f971-4d38-b27f-97396854aac0Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1 (Windows Mail):
http://www.microsoft.com/downloads/details.aspx?FamilyId=3bf7eb8a-b347-4661-be2d-682adc713769Windows Server 2008 for 32-bit Systems (Windows Mail):
http://www.microsoft.com/downloads/details.aspx?FamilyId=dc3c4b63-acd3-4469-8d47-e0562d99ee65For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-048.
-
Microsoft Event System Could Allow Remote Code Execution (MS08-049)
- Severity
- Critical 4
- Qualys ID
- 90448
- Vendor Reference
- MS08-049
- CVE Reference
- CVE-2008-1456, CVE-2008-1457
- CVSS Scores
- Base 9 / Temporal 7
- Description
-
This update resolves two privately reported vulnerabilities in Microsoft Windows Event System that could allow remote code execution.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2008 Updates are Available (including for XPe SP3 and Standard) (KB950974)
August 2008 Security Updates Are Now Available (KB950974)
- Consequence
- An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=1b2ad648-7dc9-407a-99f6-f39922746027Windows XP Service Pack 2 and Windows XP Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=01a34aa4-a456-4efc-a93a-c3c682b0181cWindows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyID=246b2686-e330-47a2-b4d4-68f218ad4021Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyID=92a3d08f-c117-4b24-bc78-2b913d270df6Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyID=6bfbb6d8-5106-4adf-83cb-35ffc6e8eaf8Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyID=45356565-697f-41b3-9879-3edd11dbcb7eWindows Vista and Windows Vista Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=6418c78f-f008-4028-beb1-5a5ea8e797a1Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=e03ccfb0-3ea3-4c59-adcf-9882d7086013Windows Server 2008 for 32-bit Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=0640f95e-1eee-4dd1-b4dd-2b82b7e984b9Windows Server 2008 for x64-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=51a93538-5e94-4f81-a6e0-d497a7b4899dWindows Server 2008 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=390da130-749d-4890-aad7-be91e15b32bbRefer to Micrsoft Security Bulletin MS08-049 for further details.
-
Microsoft Windows Messenger Information Disclosure Vulnerability (MS08-050)
- Severity
- Critical 4
- Qualys ID
- 90449
- Vendor Reference
- MS08-050
- CVE Reference
- CVE-2008-0082
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
An information disclosure vulnerability exists in Windows Messenger which occurs due to scripting of a particular ActiveX control (Messenger.UIAutomation.1).
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2008 Updates are Available (including for XPe SP3 and Standard) (KB946648)
August 2008 Security Updates Are Now Available (KB946648)
- Consequence
- An attacker could change state, get contact information and initiate audio and video chat sessions without the knowledge of the logged on user. An attacker could also impersonate the user by capturing the user's logon ID and remotely log on to the user's Messenger client.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows Messenger 4.7):
http://www.microsoft.com/downloads/details.aspx?FamilyID=8f588f7e-c4ed-42a0-b157-54b1eda60474Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Windows Messenger 4.7):
http://www.microsoft.com/downloads/details.aspx?FamilyID=a5fc5457-832f-4ee8-be60-4cc8518d1c10Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Windows Messenger 4.7):
http://www.microsoft.com/downloads/details.aspx?FamilyID=302315a8-ccb2-47c2-9104-b8e1d1f49aa0Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Windows Messenger 4.7):
http://www.microsoft.com/downloads/details.aspx?FamilyID=be94d138-7d7b-489e-baa6-e214950be6b9Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Windows Messenger 4.7):
http://www.microsoft.com/downloads/details.aspx?FamilyID=e4b72618-536b-4a21-bd91-d91be9ca24e5Microsoft Windows 2000 Service Pack 4 (Windows Messenger 5.1):
http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows Messenger 5.1):
http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Windows Messenger 5.1):
http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Windows Messenger 5.1):
http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Windows Messenger 5.1):
http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-050.
-
Microsoft PowerPoint Could Allow Remote Code Execution (MS08-051)
- Severity
- Urgent 5
- Qualys ID
- 110083
- Vendor Reference
- MS08-051
- CVE Reference
- CVE-2008-0120, CVE-2008-0121, CVE-2008-1455
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Three vulnerabilities exist in Microsoft Office PowerPoint and Microsoft Office PowerPoint Viewer that could allow remote code execution.
The security update addresses the following issues:
- Memory Allocation Vulnerability (CVE-2008-0120)
- Memory Calculation Vulnerability (CVE-2008-0121)
- Parsing Overflow Vulnerability (CVE-2008-1455) - Consequence
- An attacker who successfully exploits any of these vulnerabilities could take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3 (Microsoft Office PowerPoint 2000 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=e7c044d8-778a-4985-b25b-4f7f6e4abaddMicrosoft Office XP Service Pack 3 (Microsoft Office PowerPoint 2002 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=f8921074-7985-4d42-ac2b-d2f3b1d466baMicrosoft Office 2003 Service Pack 2 (Microsoft Office PowerPoint 2003 Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=7a7c21f0-5e0e-4dee-9710-1ce3d565913fMicrosoft Office 2003 Service Pack 3 (Microsoft Office PowerPoint 2003 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=7a7c21f0-5e0e-4dee-9710-1ce3d565913f2007 Microsoft Office System (Microsoft Office PowerPoint 2007):
http://www.microsoft.com/downloads/details.aspx?FamilyId=55fd618a-e9c5-4f1e-b9a5-b2e47ec98ef12007 Microsoft Office System Service Pack 1 (Microsoft Office PowerPoint 2007 Service Pack 1):
http://www.microsoft.com/downloads/details.aspx?FamilyId=55fd618a-e9c5-4f1e-b9a5-b2e47ec98ef1Microsoft Office PowerPoint Viewer 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=911c8872-dec8-4b8e-9708-93dcabd3e036Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
http://www.microsoft.com/downloads/details.aspx?familyid=84ce5d58-0010-4945-bce9-67a41f898f2fMicrosoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?familyid=84ce5d58-0010-4945-bce9-67a41f898f2fMicrosoft Office 2004 for Mac:
http://www.microsoft.com/downloads/details.aspx?FamilyId=EBD3AF0C-3F62-4D18-BF45-881655683BD5Refer to Micrsoft Security Bulletin MS08-051 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.20.12-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110081
- 110082
- 110084
- 110085
- 100059
- 90450
- 90447
- 90451
- 90448
- 90449
- 110083
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.