Microsoft security alert.
March 13, 2012
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 7 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Visual Studio Privilege Escalation Vulnerability (MS12-021)
- Severity
- Critical 4
- Qualys ID
- 90787
- Vendor Reference
- MS12-021
- CVE Reference
- CVE-2012-0008
- CVSS Scores
- Base 6.9 / Temporal 5.1
- Description
-
Visual Studio add-ins implement an extensibility interface within Visual Studio for customizing and automating the interactive development environmen.
An elevation of privilege vulnerability exists in Visual Studio. This vulnerability is caused by Visual Studio loading add-ins from insecure file locations.
Microsoft has released a security update that addresses the vulnerability by correcting the manner in which Visual Studio restricts where add-ins are loaded.
This security update is rated Important for all supported editions of Microsoft Visual Studio 2008 and Microsoft Visual Studio 2010.
- Consequence
- The vulnerability could allow elevation of privilege if an attacker places a specially crafted add-in in the path used by Visual Studio and convinces a user with higher privileges to start Visual Studio. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Visual Studio 2008 Service Pack 1
Microsoft Visual Studio 2010 Service Pack 1
Refer to Microsoft Security Bulletin MS12-021 for further details.
-
Microsoft Windows DirectWrite Could Allow Denial of Service Vulnerability (MS12-019)
- Severity
- Serious 3
- Qualys ID
- 90786
- Vendor Reference
- MS12-019
- CVE Reference
- CVE-2012-0156
- CVSS Scores
- Base 4.3 / Temporal 3.4
- Description
-
DirectWrite is a full Unicode, resolution-independent, multi-format text rendering API that supports measuring, drawing and hit-testing of text.
This security update addresses the vulnerability by changing the way that DirectWrite renders Unicode characters.
Affected Software:
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1This security update is rates as Moderate.
- Consequence
- In an Instant Messenger-based attack, this vulnerability could allow denial of service if an attacker sends a specially crafted sequence of Unicode characters directly to an Instant Messenger client. The target application could become unresponsive when DirectWrite renders the specially crafted sequence of Unicode characters.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS12-019 for further details.
-
Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS12-018)
- Severity
- Critical 4
- Qualys ID
- 90785
- Vendor Reference
- MS12-018
- CVE Reference
- CVE-2012-0157
- CVSS Scores
- Base 7.2 / Temporal 5.3
- Description
-
The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.
The security update addresses the vulnerability by correcting the way the Windows kernel-mode driver handles window messaging.
Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1This security update is rated Critical.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
March 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2641653)
April 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2641653)
- Consequence
- This vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS12-018 for further details.
-
Microsoft Expression Design Remote Code Execution Vulnerability (MS12-022)
- Severity
- Critical 4
- Qualys ID
- 90784
- Vendor Reference
- MS12-022
- CVE Reference
- CVE-2012-0016
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Microsoft Expression Design is a professional illustration vector and raster graphic design tool for web images.
A remote code execution vulnerability exists in the way Microsoft Expression Design handles the loading of DLL files. The vulnerability occurs when Microsoft Expression Design incorrectly restricts the path used for loading external libraries. (CVE-2012-0016)
Affected Software:
Microsoft Expression Design
Microsoft Expression Design Service Pack 1
Microsoft Expression Design 2
Microsoft Expression Design 3
Microsoft Expression Design 4This security update is rated Important.
- Consequence
- An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Expression Design Service Pack 1
Refer to Microsoft Security Bulletin MS12-022 for further details.
-
Microsoft Windows Remote Desktop Protocol Remote Code Execution Vulnerability (MS12-020)
- Severity
- Urgent 5
- Qualys ID
- 90783
- Vendor Reference
- MS12-020
- CVE Reference
- CVE-2012-0002, CVE-2012-0152
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
The Remote Desktop feature in Windows enables access to all of the programs, resources and accessories on a user's computer from a second Windows-based computer.
A remote code execution vulnerability exists in the way the Remote Desktop Protocol accesses an object in memory that has been improperly initialized or has been deleted (CVE-2012-0002).
A denial of service vulnerability exists in the way the Remote Desktop Protocol service processes packets. An attacker who successfully exploited this vulnerability could cause the target service to stop responding (CVE-2012-0152).
This security update is rated Critical for all supported releases of Microsoft Windows.
Note:
NLA or network layer authentication is a layer of security on top of RDP. If NLA is enabled then the vulnerability can be exploited remotely but will need credentials.
1. The authenticated check will determine presence of this vulnerability irrespective of the NLA setting.
2. The remote check can determine presence of this vulnerability only if NLA is disabled.
We encourage customers to patch irrespective of the NLA status.Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
March 2012 Security Updates for XPe SP3 and Standard 2009 Are Now on ECE (KB2621440)
April 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2621440)
Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory. - Consequence
- Successfully exploiting these vulnerabilities might allow a remote attacker to execute arbitrary code or cause a denial of service.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS12-020 for further details.
-
Microsoft Windows DNS Server Denial of Service Vulnerability (MS12-017)
- Severity
- Serious 3
- Qualys ID
- 90782
- Vendor Reference
- MS12-017
- CVE Reference
- CVE-2012-0006
- CVSS Scores
- Base 5 / Temporal 3.7
- Description
-
Microsoft Windows DNS server is vulnerable to a denial of service issue due to improper handling of objects in memory when looking up the resource record of a domain.
This security update is rated Important for 32-bit and x64-based editions of Windows Server 2008, and x64-based editions of Windows Server 2008 R2; and all supported editions of Windows Server 2003.
- Consequence
- An attacker that successfully exploits this vulnerability could cause the DNS system to stop responding and restart.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Workaround:
Disable the DNS service if you are not using it.
These new vulnerability checks are included in Qualys vulnerability signature 2.2.72-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90787
- 90786
- 90785
- 90784
- 90783
- 90782
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.