Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Qualys Cloud Platform to protect organizations against 23 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Word Remote Code Execution Vulnerability (MS12-029)

  Severity

  Urgent 5

  Qualys ID

  110181

  Vendor Reference

  MS12-029

  CVE Reference

  CVE-2012-0183

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Word is a proprietary word processing application written and distributed by Microsoft for Microsoft Windows and Mac OS X.

  Word is prone to an RTF Mismatch Vulnerability.

  A remote code execution vulnerability exists in the way that Microsoft Office software parses specially crafted RTF-formatted data. System memory may be corrupted in such a way that an attacker could execute arbitrary code.

  Affected Software:
  Microsoft Word 2003 Service Pack 3, Microsoft Word 2007 Service Pack 2, Microsoft Word 2007 Service Pack 3
  Microsoft Office 2008 for Mac, Microsoft Office for Mac 2011, Microsoft Office Compatibility Pack Service Pack 2 and Microsoft Office Compatibility Pack Service Pack 3.

  This security update is rated Critical

  Consequence

  An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2003 Service Pack 3 (Microsoft Word 2003 Service Pack 3)

  Microsoft Office 2007 Service Pack 2 (Microsoft Word 2007 Service Pack 2)

  Microsoft Office 2007 Service Pack 3 (Microsoft Word 2007 Service Pack 3)

  Microsoft Office 2008 for Mac

  Microsoft Office for Mac 2011

  Microsoft Office Compatibility Pack Service Pack 2

  Microsoft Office Compatibility Pack Service Pack 3

  Refer to Microsoft Security Bulletin MS12-029 for further details.

• Microsoft Office Remote Code Execution Vulnerability (MS12-030)

  Severity

  Critical 4

  Qualys ID

  110160

  Vendor Reference

  MS12-030

  CVE Reference

  CVE-2012-0141, CVE-2012-0142, CVE-2012-0143, CVE-2012-0184, CVE-2012-0185, CVE-2012-1847

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft.

  A remote code execution vulnerability exists in the way that Microsoft Excel handles specially crafted Excel files.
  This security update is rated Important

  Affected Versions:
  Microsoft Excel 2003 Service Pack 3
  Microsoft Excel 2007 Service Pack 2 and Service Pack 3
  Microsoft Office 2007 Service Pack 2 and Service Pack 3
  Microsoft Excel 2010 and Microsoft Office 2010 Service Pack 1
  Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1
  Microsoft Office 2008 for Mac
  Microsoft Office 2011 for Mac
  Microsoft Excel Viewer and
  Microsoft Office Compatibility Pack Service Pack 2 and Service Pack 3
  

  Consequence

  The vulnerabilities could allow remote code execution if a user opens a specially crafted Office file. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the logged-on user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3)

  Microsoft Office 2007 Service Pack 2 (Microsoft Excel 2007 Service Pack 2)

  Microsoft Office 2007 Service Pack 2

  Microsoft Office 2007 Service Pack 3 (Microsoft Excel 2007 Service Pack 3)

  Microsoft Office 2007 Service Pack 3

  Microsoft Office 2010 (32-bit editions) (Microsoft Excel 2010 (32-bit editions))

  Microsoft Office 2010 (32-bit editions)

  Microsoft Office 2010 Service Pack 1 (32-bit editions) (Microsoft Excel 2010 Service Pack 1 (32-bit editions))

  Microsoft Office 2010 Service Pack 1 (32-bit editions)

  Microsoft Office 2010 (64-bit editions) (Microsoft Excel 2010 (64-bit editions))

  Microsoft Office 2010 (64-bit editions)

  Microsoft Office 2010 Service Pack 1 (64-bit editions) (Microsoft Excel 2010 Service Pack 1 (64-bit editions))

  Microsoft Office 2010 Service Pack 1 (64-bit editions)

  Microsoft Office 2008 for Mac

  Microsoft Office for Mac 2011

  Microsoft Excel Viewer

  Microsoft Office Compatibility Pack Service Pack 2

  Microsoft Office Compatibility Pack Service Pack 3

  Refer to Microsoft Security Bulletin MS12-030 for further details.

  Workaround:
  Disable the opening of the older binary format files and use MOICE to convert the file to the newer XML-based format. Refer to MOICE and File Block Policy for further information.

• Microsoft Visio Viewer 2010 Remote Code Execution Vulnerability (MS12-031)

  Severity

  Critical 4

  Qualys ID

  110172

  Vendor Reference

  MS12-031

  CVE Reference

  CVE-2012-0018

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Visio Viewer is an ActiveX control used to render Visio documents inside of Internet Explorer.

  The vulnerability occurs when an embedded Visio file contains multiple stylesheets with the same ID. When this occurs, a dynamically allocated pointer is incorrectly freed multiple times. This can lead to memory corruption, which can result in the execution of arbitrary code.

  This security update is rated Important for all supported editions of Microsoft Visio Viewer 2010. Affected Software:-
  Microsoft Visio Viewer 2010 and Microsoft Visio Viewer 2010 Service Pack 1 (32-bit editions)
  Microsoft Visio Viewer 2010 and Microsoft Visio Viewer 2010 Service Pack 1 (64-bit editions)

  Consequence

  The vulnerability could allow remote code execution if a user opens a specially crafted Visio file. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Visio Viewer 2010 (32-bit Edition)

  Microsoft Visio Viewer 2010 Service Pack 1 (32-bit Edition)

  Microsoft Visio Viewer 2010 (64-bit Edition)

  Microsoft Visio Viewer 2010 Service Pack 1 (64-bit Edition)

  Refer to Microsoft Security Bulletin MS12-031 for further details.

  Workaround:
  Since this vulnerability is present in an ActiveX control, the killbit can be set to prevent the control from loading in Internet Explorer. The CLSID for the control is F8CF7A98-2C45-4c8d-9151-2D716989DDAB. Setting the killbit for this CLSID will prevent exploitation.

• Microsoft Windows TCP/IP Elevation of Privilege Vulnerability (MS12-032)

  Severity

  Critical 4

  Qualys ID

  90802

  Vendor Reference

  MS12-032

  CVE Reference

  CVE-2012-0174, CVE-2012-0179

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  TCP/IP is a set of networking protocols that are widely used on the Internet.

  The security update addresses the vulnerabilities by modifying the way Windows Firewall handles outbound broadcast packets and by modifying the way the Windows TCP/IP stack handles the binding of an IPv6 address to a local interface.

  This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7 and Windows Server 2008 R2.

  Consequence

  This vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems

  Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for Itanium-based Systems

  Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Refer to Microsoft Security Bulletin MS12-032 for further details.

• Microsoft Windows Partition Manager Elevation of Privilege Vulnerability (MS12-033)

  Severity

  Critical 4

  Qualys ID

  90800

  Vendor Reference

  MS12-033

  CVE Reference

  CVE-2012-0178

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  Windows Partition Manager is responsible for discovering, creating, deleting, and managing partitions.

  The security update addresses the vulnerability by correcting the way that Windows Partition Manager allocates objects in memory.

  This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

  Consequence

  This vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems

  Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for Itanium-based Systems

  Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Refer to Microsoft Security Bulletin MS12-033 for further details.

• Microsoft Combined Security Update for Microsoft Office, Windows, .NET Framework and Silverlight (MS12-034)

  Severity

  Urgent 5

  Qualys ID

  90803

  Vendor Reference

  MS12-034

  CVE Reference

  CVE-2011-3402, CVE-2012-0159, CVE-2012-0162, CVE-2012-0164, CVE-2012-0165, CVE-2012-0167, CVE-2012-0176, CVE-2012-0180, CVE-2012-0181, CVE-2012-1848

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft Components are prone to multiple vulnerabilities.

  A remote code execution vulnerability exists in the way affected components handle a specially crafted TrueType font file. (CVE-2011-3402,CVE-2012-0159)

  A remote code execution vulnerability exists in Microsoft .NET Framework that can allow a specially crafted Microsoft .NET Framework application to access memory in an unsafe manner. This occurs when the Microsoft .NET Framework improperly allocates a buffer in memory. (CVE-2012-0162)

  A denial of service vulnerability exists in the way .NET Framework compares the value of an index. (CVE-2012-0164)

  A remote code execution vulnerability exists in the way GDI+ handles validation of specially crafted EMF images. (CVE-2012-0165)

  A remote code execution vulnerability exists in Microsoft Silverlight that can allow a specially crafted Silverlight application to access memory in an unsafe manner. (CVE-2012-0176)

  An elevation of privilege vulnerability exists in the way the Windows kernel-mode driver manages the functions related to Windows and Message handling. (CVE-2012-0180)

  An elevation of privilege vulnerability exists in the way the Windows kernel-mode driver manages Keyboard Layout files. (CVE-2012-0181,CVE-2012-1848)

  Affected Software:
  Windows XP, Windows Server 2003, Vista, 2008, Windows 7, 2008 R2
  Microsoft .NET Framework 3.0 Service Pack 2
  Microsoft .NET Framework 3.5.1
  Microsoft .NET Framework 4
  Microsoft Office 2003 Service Pack 3
  Microsoft Office 2007 Service Pack 2
  Microsoft Office 2007 Service Pack 3
  Microsoft Office 2010
  Microsoft Office 2010 Service Pack 1
  Microsoft Silverlight 4
  Microsoft Silverlight 5

  This security update is rated Critical.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  May 2012 Security Updates Are On ECE For XPe SP3 and Standard 2009 (KB2656405, 2656407, 2659262, 2676562, 2686509)
  June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2656405, 2686509, 2676562, 2656407, 2659262)
  December 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2690729, 2636927)
  

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and take complete control of the affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Service Pack 3

  Windows XP Service Pack 3

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows XP Professional x64 Edition Service Pack 2

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista Service Pack 2

  Windows Vista Service Pack 2

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-034.

• Microsoft .NET Framework Remote Code Execution Vulnerabilities (MS12-035)

  Severity

  Urgent 5

  Qualys ID

  90801

  Vendor Reference

  MS12-035

  CVE Reference

  CVE-2012-0160, CVE-2012-0161

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.

  Microsoft .NET is prone to the following vulnerabilities:

  A vulnerability occurs when the serialization process within the .NET Framework incorrectly treats untrusted data as trusted.

  A vulnerability occurs when the .NET Framework improperly handles an exception during the object serialization process.

  Microsoft has released a security update that addresses these vulnerabilities by correcting the manner in which the .NET Framework serialization process handles trusted and untrusted data.

  This security update is rated Critical for all supported editions of the Microsoft .NET Framework on all supported editions of Microsoft Windows.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  May 2012 Security Updates Are On ECE For XPe SP3 and Standard 2009 (KB2604121, 2604092, 2604110, 2604111)
  June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2604121, 2604092, 2604111, 2604110)
  

  Consequence

  These vulnerabilities could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs).

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Microsoft .NET Framework 1.1 Service Pack 1)

  Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows XP Service Pack 3 (Microsoft .NET Framework 3.0 Service Pack 2)

  Windows XP Service Pack 3 (Microsoft .NET Framework 3.5 Service Pack 1)

  Windows XP Service Pack 3 (Microsoft .NET Framework 4)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.0 Service Pack 2)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 3.0 Service Pack 2)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 3.5 Service Pack 1)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-035.

  Workaround:
  1) Disable XAML browser applications in Internet Explorer

  Impact of workaround #1: Microsoft .NET code will not run in Internet Explorer or will not run without prompting. Disabling Microsoft .NET applications and components in the Internet and Local intranet security zones may cause some websites to work incorrectly.

  2) Disable partially trusted Microsoft .NET applications

  Impact of workaround #2: Microsoft .NET applications may not run.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Qualys Cloud Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.