Microsoft security alert.
January 10, 2012
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 8 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Windows Kernel Security Feature Bypass Vulnerability (MS12-001)
- Severity
- Critical 4
- Qualys ID
- 90766
- Vendor Reference
- MS12-001
- CVE Reference
- CVE-2012-0001
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
The Windows Kernel is the core of the operating system. It provides system level services such as device management and memory management, allocates processor time to processes, and manages error handling.
The kernel is prone to a vulnerability that occurs when the Windows kernel loads a structured exception handling table into the "Load Configuration" PE header during binary execution.
Microsoft has released a security update that addresses the vulnerability by modifying the way the Windows kernel loads structured exception handling tables.
The security update is rated Important for supported x64-based editions of Windows XP and all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.
- Consequence
- An attacker who successfully exploits this vulnerability could bypass the SafeSEH security feature to facilitate the exploitation of other vulnerabilities.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS12-001 for further details.
Workaround:
1) Recompile software using a newer version of Microsoft Visual C++ since only software applications that were compiled using Microsoft Visual C++ .NET 2003 can be used to exploit this vulnerability.2) Enable Structured Exception Handling Overwrite Protection.
-
Microsoft Windows Object Packager Remote Code Execution Vulnerability (MS12-002)
- Severity
- Critical 4
- Qualys ID
- 90771
- Vendor Reference
- MS12-002
- CVE Reference
- CVE-2012-0009
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Microsoft Windows Object Packager is a tool that can be used to create a package that can be inserted into a file.
A remote code execution vulnerability exists in the way Windows registers and uses the Windows Object Packager. (CVE-2012-0009)
Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based SystemsWindows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
January 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2603381)
February 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2603381)
- Consequence
- If this vulnerability is successfully exploited, an attacker could run arbitrary code as the logged-on user and take complete control of the system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Refer to Microsoft Security Bulletin MS12-002 for further details.
-
Microsoft Windows Client/Server Run-Time Subsystem Elevation of Privilege Vulnerability (MS12-003)
- Severity
- Serious 3
- Qualys ID
- 90768
- Vendor Reference
- MS12-003
- CVE Reference
- CVE-2012-0005
- CVSS Scores
- Base 6.9 / Temporal 5.1
- Description
-
Microsoft CSRSS (Client/Server Runtime Subsystem) is an essential Windows subsystem. The CSRSS is responsible for console windows, creating and/or deleting threads.
An elevation of privilege vulnerability occurs when Windows systems that are configured with a Chinese, Japanese or Korean system locale process crafted Unicode characters that have not been properly initialized in the memory buffer.
Microsoft has released a security update that corrects the way CSRSS processes Unicode characters.
This security update is rated Important for all supported editions of Windows XP, Windows Server 2003, Vista and Windows Server 2008.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
January 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2646524)
February 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2646524)
- Consequence
- This issue can be exploited by malicious local users to gain escalated privileges.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Refer to Microsoft Security Bulletin MS12-003 for further details.
-
Microsoft Windows Media Remote Code Execution Vulnerability (MS12-004)
- Severity
- Critical 4
- Qualys ID
- 90767
- Vendor Reference
- MS12-004
- CVE Reference
- CVE-2012-0003, CVE-2012-0004
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
This security update resolves two privately reported vulnerabilities in Microsoft Windows. A remote code execution vulnerability exists in the way that Windows handles media files. The security update addresses the vulnerabilities by correcting the way Windows Media Player handles specially crafted MIDI files and the way DirectShow parses media files.
This security update is rated Critical.
Affected Versions:-
Windows XP,
Windows Server 2003,
Windows Vista,
Windows Server 2008,
Windows Media Center TV Pack for Windows Vista, Windows 7 and Windows Server 2008 R2.Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
January 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2598479, 2631813)
February 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2598479, 2631813)
- Consequence
- These vulnerabilities could allow remote code execution if a user opens a specially crafted media file. An attacker who successfully exploits these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Windows Multimedia Library)
Windows XP Service Pack 3 (DirectShow)
Windows XP Media Center Edition 2005 Service Pack 3 (Windows Multimedia Library)
Windows XP Media Center Edition 2005 Service Pack 3 (DirectShow)
Windows XP Professional x64 Edition Service Pack 2 (Windows Multimedia Library)
Windows XP Professional x64 Edition Service Pack 2 (DirectShow)
Windows Server 2003 Service Pack 2 (Windows Multimedia Library)
Windows Server 2003 Service Pack 2 (DirectShow)
Windows Server 2003 x64 Edition Service Pack 2 (Windows Multimedia Library)
Windows Server 2003 x64 Edition Service Pack 2 (DirectShow)
Windows Server 2003 with SP2 for Itanium-based Systems (Windows Multimedia Library)
Windows Server 2003 with SP2 for Itanium-based Systems (DirectShow)
Windows Vista Service Pack 2 (Windows Multimedia Library)
Windows Vista Service Pack 2 (DirectShow)
Windows Server 2008 for 32-bit Systems Service Pack 2 (DirectShow)
Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Multimedia Library )
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-004.
-
Microsoft Windows Remote Code Execution Vulnerability (MS12-005)
- Severity
- Critical 4
- Qualys ID
- 90769
- Vendor Reference
- MS12-005
- CVE Reference
- CVE-2012-0013
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
ClickOnce is a deployment technology that allows developers to create self-updating Windows-based applications that can be installed and run with minimal user interaction. A ClickOnce application is any Windows Presentation Foundation (.xbap), Windows Forms (.exe), console application (.exe), or Office solution (.dll) published using ClickOnce technology.
A remote code execution vulnerability exists in the way Windows Packager loads ClickOnce applications embedded in Microsoft Office files.
This security update is rated Important for all supported releases of Microsoft Windows.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
January 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2584146)
February 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2584146)
- Consequence
- Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS12-005 for further details.
-
Microsoft Windows Secure Sockets Layer/Transport Layer Security (SSL/TLS) Information Disclosure Vulnerability (MS12-006)
- Severity
- Serious 3
- Qualys ID
- 90741
- Vendor Reference
- MS12-006
- CVE Reference
- CVE-2011-3389
- CVSS Scores
- Base 4.3 / Temporal 3.4
- Description
-
Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are cryptographic protocols that provide communication security over the Internet.
This security update resolves a publicly disclosed vulnerability in SSL 3.0 and TLS 1.0. The vulnerability could allow information disclosure if an attacker intercepts encrypted web traffic served from an affected system.
Affected Versions:-
Windows XP,
Windows Server 2003,
Windows Vista,
Windows Server 2008 and ,
Windows 7.Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
January 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2585542)
February 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2585542)
- Consequence
-
Successfully exploiting this vulnerability might allow a remote attacker to gain access to sensitive information.
This vulnerability primarily impacts HTTPS traffic, since the browser is the primary attack vector, and all web traffic served via HTTPS or mixed content HTTP/HTTPS is affected.This vulnerability affects the protocol itself and is not specific to the Windows operating system. - Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-006.
-
Microsoft AntiXSS Library Information Disclosure Vulnerability (MS12-007)
- Severity
- Serious 3
- Qualys ID
- 90770
- Vendor Reference
- MS12-007
- CVE Reference
- CVE-2012-0007
- CVSS Scores
- Base 4.3 / Temporal 3.6
- Description
-
The Microsoft Anti Cross Site Scripting (AntiXSS) Library is an encoding library designed to help developers protect their ASP.NET web-based applications from XSS attacks.
The vulnerability is the result of the Microsoft Anti Cross Site Scripting (AntiXSS) Library incorrectly evaluating certain characters after a CSS escaped character is detected.
Microsoft has released an update that addresses the vulnerability by upgrading the AntiXSS Library to a version that is not affected by the vulnerability.
This security update is rated Important for the AntiXSS Library V3.x and the AntiXSS Library V4.0, V4.2.0.
- Consequence
- This is an information disclosure vulnerability. An attacker who successfully exploits this vulnerability could pass a malicious script through a sanitization function and expose information not intended to be disclosed.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Refer to Microsoft Security Bulletin MS12-007 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 2.2.20-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90766
- 90771
- 90768
- 90767
- 90769
- 90741
- 90770
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.