Microsoft security alert.
June 12, 2012
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 26 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Internet Explorer Cumulative Security Update (MS12-037)
- Severity
- Critical 4
- Qualys ID
- 100116
- Vendor Reference
- MS12-037
- CVE Reference
- CVE-2012-1523, CVE-2012-1858, CVE-2012-1872, CVE-2012-1873, CVE-2012-1874, CVE-2012-1875, CVE-2012-1876, CVE-2012-1877, CVE-2012-1878, CVE-2012-1879, CVE-2012-1880, CVE-2012-1881, CVE-2012-1882
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
Microsoft Internet Explorer is a Web browser available for Microsoft Windows.
Internet Explorer is prone to multiple vulnerabilities that could allow remote code execution.
Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory, HTML sanitization using toStaticHTML, the way that Internet Explorer renders data during certain processes, and the way that Internet Explorer creates and initializes strings.
This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows servers.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2699988)
- Consequence
- The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Security Update for Internet Explorer 10 for Windows 8 Consumer Preview (KB2699988) Security Update for Internet Explorer 10 for Windows Server 8 Beta for x64-based Systems (KB2699988) Security Update for Internet Explorer 10 for Windows 8 Consumer Preview for x64-based Systems (KB2699988) (Internet Explorer 6) Security Update for IE 8 for Windows Server 2008 for 32-bit Systems Service Pack 2 Security Update for IE 6 for Windows XP SP3 Security Update for IE 7 for Windows XP SP3 Security Update for IE 8 for Windows XP SP3 Security Update for IE 8 for Windows XP Professional X64 Edition SP 2 Security Update for IE 6 for Windows XP Professional X64 Edition SP 2 Security Update for IE 7 for Windows XP Professional X64 Edition SP 2 Security Update for IE 8 for Windows Vista x64 Edition SP 2 Security Update for IE 7 for Windows Vista x64 Edition SP2 Security Update for IE 9 for Windows Vista x64 Edition SP2 Security Update for IE 9 for Windows Vista SP2 Security Update for IE 8 for Windows Vista SP2 Security Update for IE 7 for Windows Vista SP2 Security Update for IE 7 for Windows Server 2008 for x64-based Systems SP2 Security Update for IE 9 for Windows Server 2008 for x64-based Systems SP2
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-037.
-
Microsoft Remote Desktop Remote Code Execution Vulnerability (MS12-036)
- Severity
- Urgent 5
- Qualys ID
- 90810
- Vendor Reference
- MS12-036
- CVE Reference
- CVE-2012-0173
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
Remote Desktop Protocol (RDP) lets users create a virtual session on their desktop computers. RDP allows remote users to access all of the data and applications on their computers.
A remote code execution vulnerability exists in the way that the RDP accesses an object in memory that has been improperly initialized or has been deleted. (CVE-2012-0173)
This security update is rated Critical.
Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2685939)
- Consequence
- An attacker who successfully exploited this vulnerability could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-036.
-
Microsoft .NET Framework Remote Code Execution Vulnerability (MS12-038)
- Severity
- Urgent 5
- Qualys ID
- 90808
- Vendor Reference
- MS12-038
- CVE Reference
- CVE-2012-1855
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.
Microsoft .NET is prone to a memory access vulnerability that is the result of the .NET Framework improperly executing a function pointer.
Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the .NET Framework validates data passed to function pointers.
This security update is rated Critical for Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Microsoft Windows.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2686827, 2686828)
- Consequence
- Exploitation could allow an attacker to execute arbitrary code in the context of the application.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Service Pack 3 (Microsoft .NET Framework 4)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 4)
Windows Vista Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Vista Service Pack 2 (Microsoft .NET Framework 4)
Windows Vista x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Vista x64 Edition Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows 7 for 32-bit Systems (Microsoft .NET Framework 3.5.1)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-038.
Workaround:
1) Disable XAML browser applications in Internet ExplorerImpact of workaround #1: Microsoft .NET code will not run in Internet Explorer or will not run without prompting. Disabling Microsoft .NET applications and components in the Internet and Local intranet security zones may cause some websites to work incorrectly.
-
Microsoft Lync Remote Code Execution Vulnerability (MS12-039)
- Severity
- Critical 4
- Qualys ID
- 90811
- Vendor Reference
- MS12-039
- CVE Reference
- CVE-2011-3402, CVE-2012-0159, CVE-2012-1849, CVE-2012-1858
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
A remote code execution vulnerability exists in the way affected components handle shared content that contains specially crafted TrueType fonts. (CVE-2011-3402,CVE-2012-0159)
A remote code execution vulnerability exists in the way that Microsoft Lync handles the loading of DLL files. (CVE-2012-1849)
An information disclosure vulnerability exists in the way that HTML is filtered that could allow an attacker to perform cross-site scripting attacks and run script in the security context of the current user. (CVE-2012-1858)
This security update is rated Important.
Affected Software:
Microsoft Communicator 2007 R2
Microsoft Lync 2010 (32-bit)
Microsoft Lync 2010 (64-bit)
Microsoft Lync 2010 Attendee
Microsoft Lync 2010 Attendee[1]
Microsoft Lync 2010 Attendant (32-bit)
Microsoft Lync 2010 Attendant (64-bit) - Consequence
- An attacker who successfully exploited this vulnerability could run arbitrary code as the current user, gain the same user rights as the current user and perform cross-site scripting attacks against Lync or Microsoft Communicator users.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Security Update for Lync 2010 Attendee (Administrator level installation) (KB2696031)
Security Update for Lync 2010 Attendee (Administrator level installation) (KB2696031)
Security Update for Office Communicator 2007 R2 (KB2708980)For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-039.
-
Microsoft Dynamics AX Enterprise Portal Privilege Escalation Vulnerability (MS12-040)
- Severity
- Critical 4
- Qualys ID
- 90809
- Vendor Reference
- MS12-040
- CVE Reference
- CVE-2012-1857
- CVSS Scores
- Base 4.3 / Temporal 3.4
- Description
-
Enterprise Portal for Microsoft Dynamics AX provides a web-based application framework that allows users to interact with data in Microsoft Dynamics AX through a web browser.
The security update resolves one privately reported vulnerability in Microsoft Dynamics AX Enterprise Portal. The vulnerability occurs when Microsoft Dynamics AX Enterprise Portal does not properly handle malicious JavaScript elements contained within a specially crafted URL, allowing the script to be displayed back to the user's browser.
This security update is rated Important.
Affected Versions:-
Microsoft Dynamics AX 2012 Enterprise Portal.
- Consequence
- The vulnerability could allow elevation of privilege if a user clicks a specially crafted URL or visits a specially crafted website. In an email attack scenario, an attacker could exploit the vulnerability by sending an email message that contains the specially crafted URL to the user of the targeted Microsoft Dynamics AX Enterprise Portal site and by convincing the user to click the specially crafted URL.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Dynamics AX 2012 (Microsoft Dynamics AX 2012 Enterprise Portal)
Microsoft Dynamics AX 2012 (Microsoft Dynamics AX 2012 Enterprise Portal )
Microsoft Dynamics AX 2012 (Microsoft Dynamics AX 2012 Enterprise Portal )
Refer to Microsoft Security Bulletin MS12-040 for further details.
-
Microsoft Windows Kernel-Mode Drivers Elevation of Privileges Vulnerability (MS12-041)
- Severity
- Critical 4
- Qualys ID
- 90812
- Vendor Reference
- MS12-041
- CVE Reference
- CVE-2012-1864, CVE-2012-1865, CVE-2012-1866, CVE-2012-1867, CVE-2012-1868
- CVSS Scores
- Base 7.2 / Temporal 5.6
- Description
-
The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.
The security update resolves the following issues.
- String Atom Class Name Handling Vulnerability due to the Windows kernel-mode drivers not properly validating input passed from user mode.
- Clipboard Format Atom Name Handling Vulnerability due to the Windows kernel-mode drivers not properly validating input passed from user mode.
- Font Resource Refcount Integer Overflow Vulnerability due to Windows kernel-mode driver failing to properly handle TrueType font loading.
- Win32k.sys Race Condition Vulnerability is caused by a race condition when specific types of threads are created.
Affected Software:
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1This security update is rated Important.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2709162)
- Consequence
- This vulnerability could allow elevation of privileges if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-041.
-
Microsoft Windows Kernel Privilege Escalation Vulnerability (MS12-042)
- Severity
- Critical 4
- Qualys ID
- 90813
- Vendor Reference
- MS12-042
- CVE Reference
- CVE-2012-0217, CVE-2012-1515
- CVSS Scores
- Base 8.3 / Temporal 6.9
- Description
-
The Windows kernel is the core of the operating system. The kernel provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.
Windows kernel is prone to multiple vulnerabilities that could allow elevation of privilege.
Microsoft has released a security update that addresses the vulnerabilities by correcting the way the Windows User Mode Scheduler handles a particular system request and the way that Windows manages BIOS ROM.
This security update is rated Important for all 32-bit editions of Windows XP and Windows Server 2003; Windows 7 for x64-based Systems; and Windows Server 2008 R2 for x64-based Systems.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2707511)
- Consequence
- The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application designed to exploit the vulnerability. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability cannot be exploited remotely or by anonymous users.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Server 2003 Service Pack 2
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS12-042 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 2.2.148-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100116
- 90810
- 90808
- 90811
- 90809
- 90812
- 90813
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.