Microsoft security alert.
December 13, 2011
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 20 vulnerabilities that were fixed in 13 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 13 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Active Directory Remote Code Execution Vulnerability (MS11-095)
- Severity
- Critical 4
- Qualys ID
- 90762
- Vendor Reference
- MS11-095
- CVE Reference
- CVE-2011-3406
- CVSS Scores
- Base 9 / Temporal 6.7
- Description
-
Active Directory Services contains an extensible and scalable set of services that enables you to efficiently manage corporate identities, credentials, information protection, and system and application settings.
A remote code execution vulnerability exists in Active Directory. To exploit this vulnerability, an attacker would first need to acquire credentials to log on to an Active Directory domain. An attacker could then run a specially crafted application that could exploit the vulnerability and take complete control over the affected system.
Affected Software:
Active Directory, ADAM, and AD LDS when installed on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 (except Itanium), Windows 7, and Windows Server 2008 R2 (except Itanium).This security update is rated Important.
- Consequence
- Successfully exploiting this vulnerability might allow a remote authenticated user to execute arbitrary code.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Active Directory Application Mode (ADAM))
Windows XP Professional x64 Edition Service Pack 2 (Active Directory Application Mode (ADAM))
Windows Server 2003 Service Pack 2 (Active Directory)
Windows Server 2003 Service Pack 2 (Active Directory Application Mode )
Windows Server 2003 x64 Edition Service Pack 2 (Active Directory)
Windows Server 2003 x64 Edition Service Pack 2 (Active Directory Application Mode )
Windows Server 2003 with SP2 for Itanium-based Systems (Active Directory)
Windows Vista Service Pack 2 (Active Directory Lightweight Directory Service (AD LDS))
Windows Vista x64 Edition Service Pack 2 (Active Directory Lightweight Directory Service (AD LDS))
Please refer to Microsoft Security Bulletin MS11-095 for further details.
-
Microsoft Office IME (Chinese) Elevation of Privilege Vulnerability (MS11-088)
- Severity
- Critical 4
- Qualys ID
- 110167
- Vendor Reference
- MS11-088
- CVE Reference
- CVE-2011-2010
- CVSS Scores
- Base 7.2 / Temporal 6.3
- Description
-
Input Method Editors (IMEs) help solve an issue associated with entering information in certain languages via a keyboard.
An elevation of privilege vulnerability exists due to the way that the Microsoft Office IME (Chinese) improperly exposes configuration options not designed to run on the secure desktop. (CVE-2011-2010)
Affected Software:
Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions)
Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions)
Microsoft Office Pinyin SimpleFast Style 2010 and Microsoft Office Pinyin New Experience Style 2010 (32-bit version)
Microsoft Office Pinyin SimpleFast Style 2010 and Microsoft Office Pinyin New Experience Style 2010 (64-bit version)This security update is rated Important.
- Consequence
- An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.
- Solution
-
Patch:
Following are links for downloading patches to fix this vulnerability:Refer to Microsoft Security Bulletin MS11-088 for further details.
-
Microsoft Kernel-Mode Drivers Remote Code Execution Vulnerability (MS11-087 and KB2639658)
- Severity
- Urgent 5
- Qualys ID
- 119717
- Vendor Reference
- 2639658, MS11-087
- CVE Reference
- CVE-2011-3402
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
Win32k.sys is a kernel-mode device driver and exists in the kernel of the Windows subsystem. It contains the window manager, which controls window displays; manages screen output; collects input from the keyboard, mouse, and other devices; and passes user messages to applications. It also contains the Graphics Device Interface (GDI), which is a library of functions for graphics output devices. Finally, it serves as a wrapper for DirectX support that is implemented in another driver (dxgkrnl.sys).
Microsoft Windows kernel is prone to a remote code execution vulnerability when a Windows kernel-mode driver fails to properly handle the TrueType font type.
This vulnerability is reported to be included in the Duqu Trojan and has been used in targeted attacks.
Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2639417)
- Consequence
- If this vulnerability is successfully exploited, attackers can execute arbitrary code with kernel-level privileges. Failed exploit attempts may result in a denial of service.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-087 for further details.
Workaround:
1. Deny access to T2EMBED.DLL
Note See Microsoft Knowledge Base Article 2639658 to use the automated Microsoft Fix it solution to enable or disable this workaround to deny access to t2embed.dll.Impact of Workaround -
Applications that rely on embedded font technology will fail to display properly.
-
Microsoft Office Remote Code Execution Vulnerability (MS11-089)
- Severity
- Critical 4
- Qualys ID
- 110168
- Vendor Reference
- MS11-089
- CVE Reference
- CVE-2011-1983
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Word is a proprietary word processing application written and distributed by Microsoft.
A remote code execution vulnerability exists in the way that Microsoft Word handles specially crafted Word files.
Microsoft has released a security update that addresses the vulnerability by correcting the way that Microsoft Word parses specially crafted Word files.
Affected Software:
Microsoft Office 2007
Microsoft Office 2010
Microsoft Office for Mac 2011
This security update is rated Important.
- Consequence
- The vulnerability could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploits this vulnerability could gain the same user rights as the logged-on user.
- Solution
-
Following are links for downloading patches to fix the vulnerabilities:
Microsoft Office 2007 Service Pack 2 and Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions)
Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions)
Refer to Microsoft Security Bulletin MS11-089. Workaround:
Do not open untrusted office files.Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS11-089 Microsoft Office 2007 Service Pack 2 and Microsoft Office 2007 Service Pack 3
MS11-089 Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions)
MS11-089 Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions)
MS11-089 Microsoft Office for Mac 2011
-
Microsoft Cumulative Security Update of ActiveX Kill Bits (MS11-090)
- Severity
- Urgent 5
- Qualys ID
- 90761
- Vendor Reference
- MS11-090
- CVE Reference
- CVE-2011-3397
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
A remote code execution vulnerability exists in the Microsoft Time component. When the binary behavior is used in Internet Explorer, the behavior may corrupt the system state in such a way that an attacker could execute arbitrary code. (CVE-2011-3397)
Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1This security update is rated Critical.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2618451)
- Consequence
- An attacker who successfully exploits this vulnerability could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Please refer to Microsoft Security Bulletin MS11-090 for further details.
-
Microsoft Office Publisher Remote Code Execution Vulnerability (MS11-091)
- Severity
- Critical 4
- Qualys ID
- 110161
- Vendor Reference
- MS11-091
- CVE Reference
- CVE-2011-1508, CVE-2011-3410, CVE-2011-3411, CVE-2011-3412
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Office Publisher is a desktop publishing application.
Multiple vulnerabilities exists in the file parsing code when Microsoft Office Publisher opens a malicious file.
This update resolves the following:
Publisher Function Pointer Overwrite Vulnerability - CVE-2011-1508
Publisher Out-of-bounds Array Index Vulnerablility - CVE-2011-3410
Publisher Invalid Pointer Vulnerability - CVE-2011-3411
Publisher Memory Corruption Vulnerability - CVE-2011-3412
Affected Software:
Microsoft Office Publisher 2003
Microsoft Office Publisher 2007
This security update is rated Important.
Previously this was a Zero Day detection. - Consequence
- An attacker can exploit this issue by persuading an unsuspecting user into opening a malicious file. This vulnerability allows attackers to execute arbitrary code on the user's system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2003 Service Pack 3 (Microsoft Publisher 2003 Service Pack 3)
Microsoft Office 2007 Service Pack 2 (Microsoft Publisher 2007 Service Pack 2)
Microsoft Office 2007 Service Pack 3 (Microsoft Publisher 2007 Service Pack 3)
Refer to Microsoft Security Bulletin MS11-091 for further details.
-
Microsoft Windows Media Player Remote Code Execution Vulnerability (MS11-092)
- Severity
- Urgent 5
- Qualys ID
- 119547
- Vendor Reference
- MS11-092
- CVE Reference
- CVE-2011-3401
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Windows Media Player is a video and audio file player for Windows-based systems. It supports multiple file formats and allows playing files from either the local file system or the network.
A vulnerability exists in the Windows Media Player XDS Codec filter during the processing of a specially crafted DVR-MS file. If a large length value is supplied within a certain chunk of a DVR-MS file, a heap allocation for the chunk data can fail and the return value of the allocation routine will not be checked for an error.
Microsoft has released a security update that addresses the vulnerability by modifying the way that Windows Media Player and Windows Media Center open specially crafted .dvr-ms files.
Affected Software:
Windows XP (including Windows XP Media Center Edition 2005)
Windows Vista
Windows 7This security update is rated Critical.
Note: Previously this was an iDefense vulnerability with ID: 647554
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2619339)
- Consequence
- If this vulnerability is successfully exploited, attackers can execute arbitrary code.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Media Center Edition 2005 Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-092.
Workaround:
It is possible to use Windows ACLs to block access to the vulnerable library. To prevent this library from loading, use the calcs program included with Windows:
cacls "%windir%\system32\encdec.dll" /E /P everyone:N
This will prevent Windows Media Player from loading this library. To undo this workaround, use the following command:
cacls "%windir%\system32\encdec.dll" /E /Reveryone
-
Microsoft Windows OLE Remote Code Execution Vulnerability (MS11-093)
- Severity
- Critical 4
- Qualys ID
- 90759
- Vendor Reference
- MS11-093
- CVE Reference
- CVE-2011-3400
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
A vulnerability exists in OLE that could lead to remote code execution if a user opens a file that contains a specially crafted OLE object. This security update addresses the vulnerability by modifying the way that OLE objects are handled in memory.
Affected Software:
Windows XP
Windows Server 2003
This security update is rated Important.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2624667)
- Consequence
- This vulnerability could allow remote code execution if a user opens a file that contains a specially crafted OLE object. An attacker who successfully exploits this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix this vulnerability:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Refer to Microsoft Security Bulletin MS11-093 for further details.
-
Microsoft PowerPoint Remote Code Execution Vulnerability (MS11-094)
- Severity
- Critical 4
- Qualys ID
- 110169
- Vendor Reference
- MS11-094
- CVE Reference
- CVE-2011-3396, CVE-2011-3413
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
A remote code execution vulnerability exists in the way that Microsoft PowerPoint handles the loading of DLL files and specially crafted PowerPoint files. The security update addresses the vulnerabilities by correcting the way that PowerPoint loads external libraries and modifying the way that it validates OfficeArt records when opening PowerPoint files.
Affected Software:
Microsoft PowerPoint 2007 Service Pack 2
Microsoft PowerPoint 2010
Microsoft Office 2008 for Mac
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2 and Microsoft PowerPoint Viewer 2007 Service Pack 2.This security update is rated Important.
- Consequence
- An attacker who successfully exploits either of the vulnerabilities could take complete control of an affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Following are links for downloading patches to fix the vulnerabilities:
Microsoft Office 2007 Service Pack 2 (Microsoft PowerPoint 2007 Service Pack 2)
Microsoft Office 2010 (32-bit editions) (Microsoft PowerPoint 2010 (32-bit editions))
Microsoft Office 2010 (64-bit editions) (Microsoft PowerPoint 2010 (64-bit editions))
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
Microsoft PowerPoint Viewer 2007 Service Pack 2
Microsoft Office 2007 Service Pack 2 (Microsoft PowerPoint 2007 Service Pack 2)
Microsoft Office 2010 (32-bit editions) (Microsoft PowerPoint 2010 (32-bit editions))
Microsoft Office 2010 (64-bit editions) (Microsoft PowerPoint 2010 (64-bit editions))
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
Microsoft PowerPoint Viewer 2007 Service Pack 2
Refer to Microsoft Security Bulletin MS11-094 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS11-094 Microsoft Office 2007 Service Pack 2(Microsoft PowerPoint 2007 Service Pack 2)
MS11-094 Microsoft Office 2008 for Mac
MS11-094 Microsoft Office 2010 (32-bit editions)(Microsoft PowerPoint 2010 (32-bit editions))
MS11-094 Microsoft Office 2010 (64-bit editions)(Microsoft PowerPoint 2010 (64-bit editions))
MS11-094 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
MS11-094 Microsoft PowerPoint Viewer 2007 Service Pack 2
-
Microsoft Excel Remote Code Execution Vulnerabilities (MS11-096)
- Severity
- Critical 4
- Qualys ID
- 110170
- Vendor Reference
- MS11-096
- CVE Reference
- CVE-2011-1986, CVE-2011-3403
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft for Windows and Mac OS X.
Microsoft Excel is vulnerable to a remote code execution vulnerability due to incorrect handling of objects in memory.
Affected Software:
Microsoft Office Excel 2003
Microsoft Office 2004 for Mac
This security update is rated Important.
- Consequence
- An attacker can exploit this issue by persuading an unsuspecting user to open a malicious file. This vulnerability allows attackers to execute arbitrary code on the user's system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3)
Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3)
Refer to Microsoft Security Bulletin MS11-096 for further details.
-
Microsoft Windows Client/Server Run-time Subsystem Elevation of Privilege Vulnerability (MS11-097)
- Severity
- Serious 3
- Qualys ID
- 90760
- Vendor Reference
- MS11-097
- CVE Reference
- CVE-2011-3408
- CVSS Scores
- Base 7.2 / Temporal 5.3
- Description
-
The Client/Server Run-time Subsystem (CSRSS) is the user-mode portion of the Win32 subsystem. CSRSS is an essential subsystem that must be running at all times. CSRSS is responsible for console windows, and creating and/or deleting threads.
An elevation of privilege vulnerability exists in the Client/Server Run-time Subsystem (CSRSS), allowing arbitrary code to be executed in the context of another process.
This security update is rated Important for all supported releases of Microsoft Windows.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2620712)
- Consequence
- Successfully exploiting this vulnerability might allow a locally authenticated attacker to gain escalated privileges.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Please refer to Microsoft Security Bulletin MS11-097 for further details.
-
Microsoft Windows Kernel Privilege Escalation Vulnerability (MS11-098)
- Severity
- Critical 4
- Qualys ID
- 90758
- Vendor Reference
- MS11-098
- CVE Reference
- CVE-2011-2018
- CVSS Scores
- Base 7.2 / Temporal 6
- Description
-
An elevation of privilege vulnerability exists in the Windows kernel due to the way the kernel accesses an object that has not been correctly initialized. The security update addresses the vulnerability by helping to ensure that the Windows kernel initializes objects in memory.
Affected Software:
32-bit editions of Windows XP
32-bit editions of Windows Server 2003
32-bit editions of Windows Vista
32-bit editions of Windows Server 2008
32-bit editions of Windows 7This security update is rated Important.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2633171)
- Consequence
- The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application designed to exploit the vulnerability. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.
- Solution
-
Patch:
Following are links for downloading patches to fix this vulnerability:Windows Server 2003 Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2003 Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Refer to Microsoft Security Bulletin MS11-098 for further details.
-
Microsoft Cumulative Security Update for Internet Explorer (MS11-099)
- Severity
- Critical 4
- Qualys ID
- 100114
- Vendor Reference
- MS11-099
- CVE Reference
- CVE-2011-1992, CVE-2011-2019, CVE-2011-3404
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Internet Explorer is a Web browser for Microsoft Windows.
Internet Explorer is prone to an information disclosure vulnerability because the Internet Explorer XSS Filter allows attackers to read content from different domains through trial and error attacks. (CVE-2011-1992)
A remote code execution vulnerability exists in the way that Internet Explorer handles the loading of DLL files. Internet Explorer does not properly restrict the path used for loading external libraries. (CVE-2011-2019)
Internet Explorer is prone to an information disclosure vulnerability because, during certain processes, Internet Explorer incorrectly renders Web pages. (CVE-2011-3404)
Affected Software:
Windows XP Service Pack 3 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
Windows Server 2003 Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
Windows Vista Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows Vista x64 Edition Service Pack 2(Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)This security update is rated Important.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2618444)
- Consequence
- An attacker who successfully exploited this vulnerability could run arbitrary code as the logged on user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. Users whose accounts are configured to have fewer user rights on the system could be less exposed than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Internet Explorer 6)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 Service Pack 2 (Internet Explorer 6)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)
Windows XP Service Pack 3 (Internet Explorer 7)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 Service Pack 2 (Internet Explorer 7)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)
Windows Vista Service Pack 2 (Internet Explorer 7)
Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)
Please refer to Microsoft Security Bulletin MS11-099 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.28.299-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90762
- 110167
- 119717
- 110168
- 90761
- 110161
- 119547
- 90759
- 110169
- 110170
- 90760
- 90758
- 100114
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.