Microsoft security alert.
June 14, 2011
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 47 vulnerabilities that were fixed in 16 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 16 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft OLE Automation Remote Code Execution Vulnerability (MS11-038)
- Severity
- Urgent 5
- Qualys ID
- 90709
- Vendor Reference
- MS11-038
- CVE Reference
- CVE-2011-0658
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Object Linking and Embedding (OLE) Automation is a Windows protocol that allows an application to share data with or to control another application.
A remote code execution vulnerability exists in OLE Automation. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged on user. (CVE-2011-0658)
Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2476490)
- Consequence
- An attacker who successfully exploited this vulnerability could take complete control of an affected system remotely. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-038 for further details.
Workaround:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently.3) Restrict access to VBScript.dll
Impact of workaround #3: Web pages and other applications that require VBScript may not display properly.
-
Microsoft .NET Framework and Microsoft Silverlight Remote Code Execution Vulnerabilities (MS11-039)
- Severity
- Urgent 5
- Qualys ID
- 90712
- Vendor Reference
- MS11-039
- CVE Reference
- CVE-2011-0664
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Silverlight is a cross-browser, cross-platform implementation of the Microsoft .NET Framework for building media experiences and rich interactive applications for the Web.
A remote code execution vulnerability exists in the Microsoft .NET Framework that can allow a specially crafted Microsoft .NET application to access memory in an unsafe manner. The vulnerability is caused when the .NET Framework and Microsoft Silverlight improperly validate arguments passed to built-in networking functions.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2478658, 2478656, 2478663)
August Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2478656)
- Consequence
- An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Microsoft .NET Framework 3.5)
Windows XP Service Pack 3 (Microsoft .NET Framework 4.0)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4.0)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 3.5)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4.0)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-039.
Workaround:
1) Disable partially trusted Microsoft .NET applications.Impact of workaround #1: Microsoft .NET applications may not run.
2) Disable XAML browser applications in Internet Explorer.
Impact of workaround #2: Microsoft .NET code will not run in Internet Explorer or will not run without prompting. Disabling Microsoft .NET applications and components in the Internet and Local intranet security zones may cause some Web sites to work incorrectly. 3) Temporarily prevent the Microsoft Silverlight ActiveX control from running in the browser.
-
Microsoft Threat Management Gateway Firewall Client Remote Code Execution Vulnerability (MS11-040)
- Severity
- Critical 4
- Qualys ID
- 90705
- Vendor Reference
- MS11-040
- CVE Reference
- CVE-2011-1889
- CVSS Scores
- Base 10 / Temporal 7.8
- Description
-
This security update resolves a privately reported vulnerability in the Microsoft Forefront Threat Management Gateway (TMG) 2010 Client, formerly named the Microsoft Forefront Threat Management Gateway Firewall Client.
This security update is rated Critical for Microsoft Forefront Threat Management Gateway 2010 Client.
- Consequence
- The vulnerability could allow remote code execution if an attacker leveraged a client computer to make specific requests on a system where the TMG firewall client is used.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Forefront Threat Management Gateway 2010 Client
Refer to Microsoft Security Bulletin MS11-040 for further details.
Workaround:
Disable the TMG Client.
-
Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS11-041)
- Severity
- Critical 4
- Qualys ID
- 90708
- Vendor Reference
- MS11-041
- CVE Reference
- CVE-2011-1873
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
The Windows kernel is the core of the operating system. It provides system level services such as device management and memory management, allocates processor time to processes, and manages error handling.
A remote code execution vulnerability exists because the Windows kernel-mode driver improperly parses specially crafted OpenType fonts on x64-based systems.
This security update is rated Critical.
- Consequence
- An attacker could run arbitrary code in kernel mode and take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-041 for further details.
Workaround:
1) Disable the WebClient serviceImpact of workaround #1: When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the Web Client service will not start, and an error message will be logged in the System log.
-
Microsoft Distributed File System Remote Code Execution Vulnerability (MS11-042)
- Severity
- Urgent 5
- Qualys ID
- 90706
- Vendor Reference
- MS11-042
- CVE Reference
- CVE-2011-1868, CVE-2011-1869
- CVSS Scores
- Base 10 / Temporal 7.8
- Description
-
This security update resolves two privately reported vulnerabilities in the Microsoft Distributed File System (DFS).
This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003, and is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
The security update addresses the vulnerabilities by correcting the way that the DFS client validates fields in specially crafted DFS referral responses and by correcting the way the DFS service handles specially crafted DFS referral responses.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2535512)
- Consequence
- The more severe of these vulnerabilities could allow remote code execution when an attacker sends a specially crafted DFS response to a client-initiated DFS request. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-042 for further details.
-
Microsoft Windows SMB Client Remote Code Execution (MS11-043)
- Severity
- Urgent 5
- Qualys ID
- 90707
- Vendor Reference
- MS11-043
- CVE Reference
- CVE-2011-1268
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol used in Microsoft Windows.
Microsoft SMB Client is prone to an unauthenticated remote code execution vulnerability exists in the way that the Microsoft Server Message Block (SMB) client implementation handles specially crafted SMB responses.
This security update is rated Critical for all supported releases of Microsoft Windows.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2536276)
August Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2536276)
- Consequence
- Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-043 for further details.
Workaround:
Block TCP ports 139 and 445 at the firewallImpact of workaround: Several Windows services use the affected ports. Blocking connectivity to the ports may cause various applications or services to not function.
-
Microsoft .NET Framework Remote Code Execution Vulnerability (MS11-044)
- Severity
- Critical 4
- Qualys ID
- 90710
- Vendor Reference
- MS11-044
- CVE Reference
- CVE-2011-1271
- CVSS Scores
- Base 5.1 / Temporal 4
- Description
-
The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.
A remote code execution vulnerability exists in the way that Microsoft .NET Framework validates certain values within an object.
This security update is rated Critical for all affected releases of Microsoft .NET Framework for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2518864, 2530095, 2518870)
August Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2518870, 2530095)
- Consequence
- Successfully exploiting this vulnerability could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs).
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Service Pack 3 (Microsoft .NET Framework 3.5)
Windows XP Service Pack 3 (Microsoft .NET Framework 3.5 Service Pack 1)
Windows XP Service Pack 3 (Microsoft .NET Framework 4.0)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4.0)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 3.5)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4.0)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-044.
Workaround:
1) Disable partially trusted Microsoft .NET applications.Impact of workaround #1: Microsoft .NET applications may not run.
2) Disable XAML browser applications in Internet Explorer.
Impact of workaround #2: Microsoft .NET code will not run in Internet Explorer or will not run without prompting. Disabling Microsoft .NET applications and components in the Internet and local intranet security zones may cause some Web sites to work incorrectly.
-
Microsoft Internet Explorer Cumulative Security Update (MS11-050)
- Severity
- Urgent 5
- Qualys ID
- 100103
- Vendor Reference
- MS11-050
- CVE Reference
- CVE-2011-1246, CVE-2011-1250, CVE-2011-1251, CVE-2011-1252, CVE-2011-1253, CVE-2011-1254, CVE-2011-1255, CVE-2011-1256, CVE-2011-1258, CVE-2011-1260, CVE-2011-1261, CVE-2011-1262
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
This security update resolves eleven privately reported vulnerabilities in Internet Explorer.
This security update is rated Critical for Internet Explorer 6 on Windows clients, Internet Explorer 7, Internet Explorer 8 and Internet Explorer 9; and Moderate for Internet Explorer 6 on Windows servers.
The security update addresses the vulnerabilities by modifying the way Internet Explorer enforces the content settings supplied by the Web server, handles HTML sanitization using toStaticHTML, handles objects in memory, and handles script during certain processes.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2530548)
Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.For details see: http://www.qualys.com/research/exploits/#MS11-050 - Consequence
- The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Internet Explorer 6)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 Service Pack 2 (Internet Explorer 6)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)
Windows XP Service Pack 3 (Internet Explorer 7)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 Service Pack 2 (Internet Explorer 7)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)
Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Internet Explorer 7)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-050.
Workaround:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently.3) Read e-mails in plain text.
-
Microsoft Internet Explorer Vector Markup Language Remote Code Execution Vulnerability (MS11-052)
- Severity
- Urgent 5
- Qualys ID
- 100102
- Vendor Reference
- MS11-052
- CVE Reference
- CVE-2011-1266
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Internet Explorer is a Web browser available for Microsoft Windows.
When Internet Explorer attempts to access an object that has not been initialized or has been deleted, it may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged on user.
Microsoft has released a security update to address the vulnerability by modifying the way Internet Explorer handles objects in memory.
This security update is rated Critical for Internet Explorer 6, Internet Explorer 7 and Internet Explorer 8 on Windows clients; and Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows servers. Internet Explorer 9 is not affected by the vulnerability.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2544521)
- Consequence
- The vulnerability could allow remote code execution if a user viewed a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Internet Explorer 6)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 Service Pack 2 (Internet Explorer 6)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)
Windows XP Service Pack 3 (Internet Explorer 7)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 Service Pack 2 (Internet Explorer 7)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)
Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Internet Explorer 7)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-052.
Workaround:
1) Set Internet and local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and local intranet security zone.
Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently.3) Read e-mails in plain text.
-
Microsoft MHTML Information Disclosure Vulnerability (MS11-037)
- Severity
- Critical 4
- Qualys ID
- 90713
- Vendor Reference
- MS11-037
- CVE Reference
- CVE-2011-1894
- CVSS Scores
- Base 4.3 / Temporal 3.6
- Description
-
MHTML (MIME Encapsulation of Aggregate HTML) is an Internet standard that defines the MIME structure used to wrap HTML content. The MHTML protocol handler in Windows provides a pluggable protocol (MHTML:) that permits MHTML encoded documents to be rendered in applications.
MHTML is prone to an information disclosure vulnerability that occurs when MHTML interprets MIME-formatted requests for content embedded in an HTML document, making it possible for an attacker to run script in the wrong security context (for example, some scripts could be run in the incorrect Internet Explorer security zone).
Microsoft has released a security update that addresses the vulnerability by correcting the way that the MHTML parser handles requests.
This security update is rated Important for all supported editions of Windows XP, Windows Vista, and Windows 7, and is rated Low for all supported editions of Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2544893)
November Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2544893)
- Consequence
- Exploitation could lead to information disclosure.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-037 for further details.
Workaround:
Disable the MHTML protocol handlerImpact of the workaround:
The MHTML protocol will cease to function. Any application that uses MHTML will be affected by this workaround.
-
Microsoft Excel Could Allow Remote Code Execution (MS11-045)
- Severity
- Critical 4
- Qualys ID
- 118896
- Vendor Reference
- MS11-045
- CVE Reference
- CVE-2011-1272, CVE-2011-1273, CVE-2011-1274, CVE-2011-1275, CVE-2011-1276, CVE-2011-1277, CVE-2011-1278, CVE-2011-1279
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft for Windows and Mac OS X.
Microsoft Excel is vulnerable to multiple remote code execution vulnerabilities.
Microsoft has released an update that addresses multiple vulnerabilities by correcting the way that Microsoft Excel manages data structures, validates record information, initializes variables used in memory operations, and allocates buffer space when parsing a specially crafted file.
This security update is rated Important for all supported editions of Microsoft Excel 2002, Microsoft Excel 2003, Microsoft Excel 2007, Microsoft Excel 2010, Microsoft Office 2004 for Mac, Microsoft Office 2008 for Mac, and Microsoft Office for Mac 2011; Open XML File Format Converter for Mac; and all supported versions of Microsoft Excel Viewer and Microsoft Office Compatibility Pack.
Previously this was an iDefense detection.
- Consequence
- By exploiting this vulnerability, attackers can execute arbitrary code with the privileges of the user opening the file. To exploit this vulnerability, an attacker needs to convince a user to open a malicious file.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office XP Service Pack 3 (Microsoft Excel 2002 Service Pack 3)
Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3)
Microsoft Office 2007 Service Pack 2 (Microsoft Excel 2007 Service Pack 2)
Microsoft Office 2010 (32-bit editions) (Microsoft Excel 2010 (32-bit editions))
Microsoft Office 2010 (64-bit editions) (Microsoft Excel 2010 (64-bit editions))
Open XML File Format Converter for Mac
Microsoft Excel Viewer Service Pack 2
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
Refer to Microsoft Security Bulletin MS11-045 for further details.
Workaround:
1) Set Office File Validation to disable the opening of files that fail validation in Excel 2003 and Excel 2007.Impact of workaround #1: Office File Validation will no longer allow the opening of suspicious files.
2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or un-trusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.
3) Microsoft Office File Block policy should be used to block the opening of Office documents from unknown or untrusted sources.
Impact of the workaround #2 and #3:
Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.
-
Microsoft Ancillary Function Driver Elevation of Privileges Vulnerability (MS11-046)
- Severity
- Critical 4
- Qualys ID
- 90717
- Vendor Reference
- MS11-046
- CVE Reference
- CVE-2011-1249
- CVSS Scores
- Base 7.2 / Temporal 6
- Description
-
The Ancillary Function Driver (AFD) supports Windows sockets applications and is contained in the afd.sys file.
An elevation of privilege vulnerability exists where the Ancillary Function Driver (afd.sys) improperly validates input passed from user mode to the kernel.
Microsoft has released a security update that addresses the vulnerability by correcting the way that AFD validates input before passing the input from user mode to the Windows kernel.
This security update is rated Important.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2503665)
- Consequence
- If this vulnerability is successfully exploited, a local attacker can execute arbitrary code and take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix this vulnerability:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-046 for further details.
-
Microsoft Hyper-V Denial of Service Vulnerability (MS11-047)
- Severity
- Urgent 5
- Qualys ID
- 90714
- Vendor Reference
- MS11-047
- CVE Reference
- CVE-2011-1872
- CVSS Scores
- Base 4.7 / Temporal 3.7
- Description
-
Hyper-V is a hypervisor-based technology that is a key feature of Windows Server 2008 and Windows Server 2008 R2.
Hyper-V is prone to a vulnerability that exists due to insufficient validation of specific packets sent from the guest to the host. Due to this lack of validation, processing of these instructions causes excess resource consumption in the Hyper-V server application.
Microsoft has released a security update that addresses the vulnerability by correcting the way that the Hyper-V Server processes malformed requests from virtual machines.
This security update is rated Important for all supported x64-based editions of Windows Server 2008 and Windows Server 2008 R2.
- Consequence
- By exploiting this vulnerability, a denial of service could be caused if a specially crafted packet is sent to the VMBus by an authenticated user in one of the guest virtual machines hosted by the Hyper-V server.
- Solution
-
Patch:
Following are links for downloading patches to fix this vulnerability:Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-047 for further details.
-
Microsoft SMB Server Denial of Service Vulnerability (MS11-048)
- Severity
- Critical 4
- Qualys ID
- 90711
- Vendor Reference
- MS11-048
- CVE Reference
- CVE-2011-1267
- CVSS Scores
- Base 7.8 / Temporal 6.1
- Description
-
Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol used in Microsoft Windows.
A denial of service vulnerability exists when the Microsoft SMB Protocol software improperly handles specially crafted SMB requests.
Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the SMB protocol software handles specially crafted SMB requests.
This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
- Consequence
- An attacker who successfully exploited this vulnerability could cause a user's system to stop responding until manually restarted.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Vista Service Pack 1 and Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-048 for further details.
Workaround:
Block TCP ports 139 and 445 at the firewallImpact of workaround: Several Windows services use the affected ports. Blocking connectivity to the ports may cause various applications or services to fail to function.
-
Microsoft Active Directory Certificate Services Web Enrollment Elevation of Privilege Vulnerability (MS11-051)
- Severity
- Urgent 5
- Qualys ID
- 90715
- Vendor Reference
- MS11-051
- CVE Reference
- CVE-2011-1264
- CVSS Scores
- Base 4.3 / Temporal 3.2
- Description
-
The vulnerability is a cross-site scripting (XSS) vulnerability that could allow elevation of privilege, enabling an attacker to execute arbitrary commands on the site in the context of the target user. An attacker who successfully exploits this vulnerability would need to send a specially crafted link and convince a user to click the link. (CVE-2011-1264)
The security update addresses the vulnerability by correcting the manner in which the Active Directory Certificate Services Web Enrollment site validates input parameters.
This security update is rated Important for all supported editions, except Itanium, of Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2.
- Consequence
- By exploiting this vulnerability, an elevation of privilege could be allowed and an attacker can inject a client-side script into the user's instance of Internet Explorer. The script could spoof content, disclose information, or take any action that the user could take on the site on behalf of the targeted user.
- Solution
-
Patch:
Following are links for downloading patches to fix this vulnerability:Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Refer to Microsoft Security Bulletin MS11-051 for further details.
Workaround:
Enable Internet Explorer 8 and Internet Explorer 9 XSS filter for Intranet ZoneImpact of workaround: Internal sites not previously flagged as being XSS risks would be flagged.
-
Adobe Reader and Acrobat Security Update (APSB11-16)
- Severity
- Critical 4
- Qualys ID
- 119076
- Vendor Reference
- APSB11-16
- CVE Reference
- CVE-2011-2094, CVE-2011-2095, CVE-2011-2096, CVE-2011-2097, CVE-2011-2098, CVE-2011-2099, CVE-2011-2100, CVE-2011-2101, CVE-2011-2102, CVE-2011-2103, CVE-2011-2104, CVE-2011-2105, CVE-2011-2106
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Adobe Acrobat and Reader are applications for handling PDF files.
A critical vulnerability exists in Adobe Reader and Adobe Acrobat. Adobe has released a security update to fix multiple issues within the product.
1) A buffer overflow vulnerability that could lead to code execution (CVE-2011-2094, CVE-2011-2095, CVE-2011-2097).
2) A heap overflow vulnerability that could lead to code execution (CVE-2011-2096).
3) A memory corruption vulnerability that could lead to code execution (CVE-2011-2098, CVE-2011-2099).
4) A DLL loading vulnerability that could lead to code execution (CVE-2011-2100).
5) A cross document script execution vulnerability that could lead to code execution (CVE-2011-2101).
6) A security bypass vulnerability in Adobe Reader X and Acrobat X (CVE-2011-2102).
7) A memory corruption vulnerability that could lead to code execution in 8.x (CVE-2011-2103)
8) A memory corruption denial of service issue (CVE-2011-2104).
9) A memory corruption issue (CVE-2011-2105).
10) A memory corruption vulnerability that could lead to code execution (Macintosh only) (CVE-2011-2106).Affected Versions:
Adobe Reader X (10.0.1) and earlier 10.x versions for Windows
Adobe Reader X (10.0.3) and earlier 10.x versions for Macintosh
Adobe Reader 9.4.4 and earlier 9.x versions for Windows and Macintosh
Adobe Reader 8.2.6 and earlier 8.x versions for Windows and Macintosh
Adobe Acrobat X (10.0.3) and earlier 10.x versions for Windows and Macintosh
Adobe Acrobat 9.4.4 and earlier 9.x versions for Windows and Macintosh
- Consequence
- Exploitation could cause a crash and potentially allow an attacker to take control of the affected system.
- Solution
-
Patch:
The vendor has released updates to resolve this issue. Please refer to Adobe Security Advisory APSA11-16.
These new vulnerability checks are included in Qualys vulnerability signature 1.28.137-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90709
- 90712
- 90705
- 90708
- 90706
- 90707
- 90710
- 100103
- 100102
- 90713
- 118896
- 90717
- 90714
- 90711
- 90715
- 119076
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.