Microsoft security alert.
October 11, 2011
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 23 vulnerabilities that were fixed in 8 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Active Accessibility Remote Code Execution Vulnerability (MS11-075)
- Severity
- Critical 4
- Qualys ID
- 90743
- Vendor Reference
- MS11-075
- CVE Reference
- CVE-2011-1247
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
The Microsoft Active Accessibility component is a Component Object Model (COM)-based technology that improves the way accessibility aids work with applications running on Microsoft Windows.
Microsoft Active Accessibility is prone to a vulnerability that is the result of the Microsoft Active Accessibility component improperly restricting the path used for loading external libraries.
Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Microsoft Active Accessibility component loads external libraries.
This security update is rated Important for all supported releases of Microsoft Windows.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
March 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2564958)
April 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2564958)
- Consequence
- Exploitation could allow an attacker to execute arbitrary code.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-075 for further details.
-
Microsoft Windows Media Center Remote Code Execution Vulnerability (MS11-076)
- Severity
- Critical 4
- Qualys ID
- 90747
- Vendor Reference
- MS11-076
- CVE Reference
- CVE-2011-2009
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
This security update resolves a publicly disclosed vulnerability in Windows Media Center. The security update addresses the vulnerability by correcting the manner in which Windows Media Center loads external libraries.
This security update is rated Important for all supported editions of Windows Vista and Windows 7; and Windows Media Center TV Pack for Windows Vista.
- Consequence
-
The vulnerability could allow remote code execution if an attacker convinces a user to open a legitimate file that is located in the same network directory as a specially crafted dynamic link library (DLL) file. Then, while opening the legitimate file, Windows Media Center could attempt to load the DLL file and execute any code it contained.
For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a legitimate file.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Vista x64 Edition Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Media Center TV Pack for Windows Vista (32-bit editions)
Windows Media Center TV Pack for Windows Vista (64-bit editions)
Refer to Microsoft Security Bulletin MS11-076 for further details.
-
Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS11-077)
- Severity
- Critical 4
- Qualys ID
- 90746
- Vendor Reference
- MS11-077
- CVE Reference
- CVE-2011-1985, CVE-2011-2002, CVE-2011-2003, CVE-2011-2011
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
This security update resolves four privately reported vulnerabilities in Microsoft Windows.
The security update addresses the vulnerabilities by correcting the way that the Windows kernel-mode drivers validate input passed from user mode, handle the TrueType font type, allocate the proper buffer size before writing to memory, and manage kernel-mode driver objects.
This security update is rated Important for all supported releases of Microsoft Windows.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
October 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2567053)
- Consequence
- The most severe of these vulnerabilities could allow remote code execution if a user opens a specially crafted font file (such as a .fon file) in a network share, a UNC or WebDAV location, or an e-mail attachment. For a remote attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open the specially crafted font file, or open the file as an e-mail attachment.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-077 for further details.
-
Microsoft .NET Framework and Silverlight Remote Code Execution Vulnerability (MS11-078)
- Severity
- Critical 4
- Qualys ID
- 90745
- Vendor Reference
- MS11-078
- CVE Reference
- CVE-2011-1253
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.
A remote code execution vulnerability exists in the way that the Microsoft .NET Framework and Silverlight framework restrict inheritance within classes.
This security update is rated Critical for Microsoft .NET Framework 1.0 Service Pack 3, Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Microsoft Windows; and Microsoft Silverlight 4.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
October 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2572078, 2572073)
- Consequence
- Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Microsoft .NET Framework 1.0 Service Pack 3)
Windows XP Service Pack 3 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Service Pack 3 (Microsoft .NET Framework 4)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 1.1 Service Pack 1)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 4)
Windows Vista Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-078.
-
Microsoft Forefront Unified Access Gateway Remote Code Execution Vulnerability (MS11-079)
- Severity
- Critical 4
- Qualys ID
- 90749
- Vendor Reference
- MS11-079
- CVE Reference
- CVE-2011-1895, CVE-2011-1896, CVE-2011-1897, CVE-2011-1969, CVE-2011-2012
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Microsoft Forefront Unified Access Gateway (UAG) is a reverse proxy and VPN solution that provides secure remote access to corporate networks for remote employees and business partners.
An HTTP response splitting vulnerability exists in Microsoft Forefront Unified Access Gateway (UAG) server where JavaScript can be injected back to the user in the resulting page, effectively allowing attacker-controlled JavaScript to run in the context of the user clicking the link. (CVE-2011-1895)
An XSS vulnerability exists in Microsoft Forefront Unified Access Gateway (UAG) server where JavaScript can be injected back to the user in the resulting page, effectively allowing attacker-controlled JavaScript to run in the context of the user clicking the link. (CVE-2011-1896)
Microsoft Forefront Unified Access Gateway (UAG) applies a signed Java applet that can be leveraged by malicious Web sites to cause remote code execution on any Java-enabled Web browser. (CVE-2011-1969)
A denial of service vulnerability exists in implementations of Microsoft Forefront Unified Access Gateway (UAG). When this occurs, an attacker could leverage the vulnerability to stop the IIS worker process and deny access to Web services on the affected system. (CVE-2011-2012)
Affected Software:
Microsoft Forefront Unified Access Gateway 2010
Microsoft Forefront Unified Access Gateway 2010 Update 1
Microsoft Forefront Unified Access Gateway 2010 Update 2
Microsoft Forefront Unified Access Gateway 2010 Service Pack 1 - Consequence
- An attacker who successfully exploits this vulnerability could read content that the attacker is not authorized to read, use the victim's identity to take actions on behalf of the victim, and inject malicious content in the browser of the victim and crash the web server on the affected UAG machine.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Forefront Unified Access Gateway 2010
Microsoft Forefront Unified Access Gateway 2010 Update 1
Microsoft Forefront Unified Access Gateway 2010 Update 2
Microsoft Forefront Unified Access Gateway 2010 Service Pack 1
Refer to Microsoft Security Bulletin MS11-079 for further details.
-
Microsoft Ancillary Function Driver Elevation of Privileges Vulnerability (MS11-080)
- Severity
- Critical 4
- Qualys ID
- 90744
- Vendor Reference
- MS11-080
- CVE Reference
- CVE-2011-2005
- CVSS Scores
- Base 7.2 / Temporal 6
- Description
-
The Ancillary Function Driver (AFD) supports Windows sockets applications and is contained in the afd.sys file.
An elevation of privilege vulnerability exists where the Ancillary Function Driver (afd.sys) improperly validates input passed from user mode to the kernel.
Microsoft has released a security update that addresses the vulnerability by correcting the way that AFD validates input before passing the input from user mode to the Windows kernel.
This security update is rated Important.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
October 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2592799)
- Consequence
- If this vulnerability is successfully exploited, a local attacker can execute arbitrary code and take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Refer to Microsoft Security Bulletin MS11-080 for further details.
-
Microsoft Internet Explorer Cumulative Security Update (MS11-081)
- Severity
- Urgent 5
- Qualys ID
- 100111
- Vendor Reference
- MS11-081
- CVE Reference
- CVE-2011-1993, CVE-2011-1995, CVE-2011-1996, CVE-2011-1997, CVE-2011-1998, CVE-2011-1999, CVE-2011-2000, CVE-2011-2001
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Internet Explorer is a Web browser available for Microsoft Windows.
When Internet Explorer attempts to access an object that has been deleted or a dereferenced memory address or a corrupted virtual function table, it may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user.
Microsoft has released an update that addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory and the way that Internet Explorer allocates and accesses memory.
This security update is rated Critical for Internet Explorer on Windows clients and Moderate for Internet Explorer on Windows servers.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
October 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2586448)
- Consequence
- The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploits any of these vulnerabilities could gain the same user rights as the local user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Internet Explorer 6)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 Service Pack 2 (Internet Explorer 6)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)
Windows XP Service Pack 3 (Internet Explorer 7)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 Service Pack 2 (Internet Explorer 7)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)
Windows Vista Service Pack 2 (Internet Explorer 7)
Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)
Windows XP Service Pack 3 (Internet Explorer 8)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-081.
-
Microsoft Host Integration Server Denial of Service Vulnerability (MS11-082)
- Severity
- Critical 4
- Qualys ID
- 90748
- Vendor Reference
- MS11-082
- CVE Reference
- CVE-2011-2007, CVE-2011-2008
- CVSS Scores
- Base 5 / Temporal 4.1
- Description
-
Microsoft Host Integration Server (HIS) is a gateway application providing connectivity between Microsoft Windows Networks and IBM mainframe and AS/400 systems.
Microsoft Host Integration Server is prone to a denial of service vulnerability that is caused due to improper input validation when Host Integration Server processes specially crafted network traffic. (CVE-2011-2008,CVE-2011-2007)
Affected Software:
Microsoft Host Integration Server 2004 Service Pack 1
Microsoft Host Integration Server 2006 Service Pack 1
Microsoft Host Integration Server 2009
Microsoft Host Integration Server 2010 - Consequence
- A remote, anonymous attacker who exploits this vulnerability could cause the affected SNA Server service and all dependent services to stop responding.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Host Integration Server 2004 Service Pack 1
Microsoft Host Integration Server 2006 Service Pack 1
Microsoft Host Integration Server 2009
Microsoft Host Integration Server 2010
Refer to Microsoft Security Bulletin MS11-082 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.28.241-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90743
- 90747
- 90746
- 90745
- 90749
- 90744
- 100111
- 90748
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.