Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 19 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Cumulative Security Update (MS12-071)

  Severity

  Urgent 5

  Qualys ID

  100124

  Vendor Reference

  MS12-071

  CVE Reference

  CVE-2012-1538, CVE-2012-1539, CVE-2012-4775

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Internet Explorer is prone to multiple vulnerabilities that could allow remote code execution.

  Microsoft released a security update that addresses the following vulnerabilities by modifying the way Internet Explorer handles objects in memory.
  - CFormElement Use After Free Vulnerability - (CVE-2012-1538)
  - CTreePos Use After Free Vulnerability - (CVE-2012-1539)
  - CTreeNode Use After Free Vulnerability - (CVE-2012-4775)
  

  Affected Software:
  Microsoft Internet Explorer version 9.

  This security update is rated Critical.

  Note: Previously this was an iDefense exclusive vulnerability with iDefense ID: 781062 and 781058.

  Consequence

  Successfully exploiting these vulnerabilities could cause denial of service or execution of arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista Service Pack 2 (Internet Explorer 9)

  Windows Vista x64 Edition Service Pack 2 (Internet Explorer 9)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 9)

  Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 9)

  Windows 7 for 32-bit Systems (Internet Explorer 9)

  Windows 7 for 32-bit Systems Service Pack 1 (Internet Explorer 9)

  Windows 7 for x64-based Systems (Internet Explorer 9)

  Windows 7 for x64-based Systems Service Pack 1 (Internet Explorer 9)

  Windows Server 2008 R2 for x64-based Systems (Internet Explorer 9)

  Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Internet Explorer 9)

  Refer to Microsoft Security Bulletin MS12-071 for further details.

  Workaround:
  Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones.
  Add sites that you trust to the Internet Explorer Trusted sites zone.
  Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.
  

• Microsoft Windows Shell Remote Code Execution Vulnerability (MS12-072)

  Severity

  Critical 4

  Qualys ID

  90844

  Vendor Reference

  MS12-072

  CVE Reference

  CVE-2012-1527, CVE-2012-1528

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  This security update resolves two privately reported vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if a user browses to a specially crafted briefcase in Windows Explorer.

  Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Microsoft Windows handles a specially crafted briefcase.

  This security update is rated Critical for all supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 (except for Windows Server 2008 for Itanium-based Systems), Windows 7, Windows Server 2008 R2 (except for Windows Server 2008 R2 for Itanium-based Systems), Windows 8 (except for Windows RT), and Windows Server 2012.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  November 2012 Security Updates Are on ECE for XPe SP3 and Standard 2009 (KB2727528)
  

  Consequence

  Successfully exploiting this vulnerability could allow an attacker to execute arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems

  Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows 8 for 32-bit Systems

  Windows 8 for 64-bit Systems

  Windows Server 2012

  Refer to Microsoft Security Bulletin MS12-072 for further details.

  Workaround:
  1) Create a backup copy of the registry keys by performing the following command from an elevated command prompt:

  Regedit.exe /e briefcase_workaround_rollback.reg HKEY_CLASSES_ROOT\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}

  2) Create a text file named Disable_briefcase.reg with the following contents:

  Windows Registry Editor Version 5.00

  [-HKEY_CLASSES_ROOT\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}]

  3) Run Disable_briefcase.reg with the following command from an elevated command prompt:

  Regedit.exe /s Disable_briefcase.reg

• Microsoft Internet Information Services (IIS) Information Disclosure Vulnerability (MS12-073)

  Severity

  Critical 4

  Qualys ID

  90842

  Vendor Reference

  MS12-073

  CVE Reference

  CVE-2012-2531, CVE-2012-2532

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  Microsoft Internet Information Service is a Web server available for Microsoft Windows.

  Microsoft IIS is prone to an information disclosure vulnerability, This vulnerability is caused by the way that the Microsoft IIS FTP service handles specially crafted FTP commands and also when Microsoft IIS improperly manages the permissions of a log file. (CVE-2012-2531, CVE-2012-2532)

  Affected Software:
  Microsoft FTP Service 7.0 for IIS 7.0
  Microsoft FTP Service 7.5 for IIS 7.0
  Microsoft FTP Service 7.5 for IIS 7.5
  Internet Information Services 7.5

  Consequence

  An attacker who successfully exploited this vulnerability could execute a limited set of FTP commands, prior to the session switching to Transport Layer Security, and discover the usernames and/or passwords of configured accounts.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Vista Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows Vista x64 Edition Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Vista x64 Edition Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows 7 for 32-bit Systems (Microsoft FTP Service 7.5 for IIS 7.5)

  Windows 7 for 32-bit Systems (Internet Information Services 7.5)

  Windows 7 for 32-bit Systems Service Pack 1 (Microsoft FTP Service 7.5 for IIS 7.5)

  Windows 7 for 32-bit Systems Service Pack 1 (Internet Information Services 7.5)

  Windows 7 for x64-based Systems (Microsoft FTP Service 7.5 for IIS 7.5)

  Windows 7 for x64-based Systems (Internet Information Services 7.5)

  Windows 7 for x64-based Systems Service Pack 1 (Microsoft FTP Service 7.5 for IIS 7.5)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-073.

• Microsoft .NET Framework Remote Code Execution Vulnerability (MS12-074)

  Severity

  Critical 4

  Qualys ID

  90841

  Vendor Reference

  MS12-074

  CVE Reference

  CVE-2012-1895, CVE-2012-1896, CVE-2012-2519, CVE-2012-4776, CVE-2012-4777

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.

  Microsoft .NET Framework is exposed to the following vulnerabilities:

  1) An elevation of privilege vulnerability exists in the way that .NET Framework validates the permissions of certain objects performing reflection (CVE-2012-1895).
  2) An information disclosure vulnerability exists in Microsoft .NET Framework due to the improper sanitization of output when a function is called from partially trusted code (CVE-2012-1896).
  3) A remote code execution vulnerability exists in the way Microsoft .NET Framework handles the loading of DLL files (CVE-2012-2519).
  4) A remote code execution vulnerability exists in the way Microsoft .Net Framework retrieves the default web proxy settings (CVE-2012-4776).
  5) An elevation of privilege vulnerability exists in the way Microsoft .Net Framework validates permissions for objects involved with reflection (CVE-2012-4777).

  This security update is rated Critical for Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4, and Microsoft .NET Framework 4.5. It is rated Important for Microsoft .NET Framework 1.0 Service Pack 3 and Microsoft .NET Framework 1.1 Service Pack 1.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  November 2012 Security Updates Are on ECE for XPe SP3 and Standard 2009 (KB2737019, 2729449, 2729450)
  

  Consequence

  Successfully exploiting these security might allow a remote attacker to execute arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Microsoft .NET Framework 1.0 Service Pack 3)

  Windows XP Service Pack 3 (Microsoft .NET Framework 1.1 Service Pack 1)

  Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows XP Service Pack 3 (Microsoft .NET Framework 4)

  Windows XP Service Pack 3 (Microsoft .NET Framework 4)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)

  Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-074.

• Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS12-075)

  Severity

  Critical 4

  Qualys ID

  90843

  Vendor Reference

  MS12-075

  CVE Reference

  CVE-2012-2530, CVE-2012-2553, CVE-2012-2897

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.

  The kernel is prone to the following vulnerabilities:

  A remote code execution vulnerability exists in the way that affected components handle a specially crafted TrueType font file.

  An elevation of privilege vulnerability exists when the Windows kernel-mode driver improperly handles objects in memory.

  Microsoft has released a security update that addresses the vulnerabilities by correcting the way that the Windows kernel-mode drivers handle objects in memory.

  This security update is rated Critical for all supported releases of Microsoft Windows.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  November 2012 Security Updates Are on ECE for XPe SP3 and Standard 2009 (KB2761226)
  

  Consequence

  An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems

  Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for Itanium-based Systems

  Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  Windows 8 for 32-bit Systems

  Windows 8 for 64-bit Systems

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-075.

• Microsoft Excel Remote Code Execution Vulnerabilities (MS12-076)

  Severity

  Critical 4

  Qualys ID

  110195

  Vendor Reference

  MS12-076

  CVE Reference

  CVE-2012-1885, CVE-2012-1886, CVE-2012-1887, CVE-2012-2543

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft.

  Excel is prone to multiple remote code execution vulnerabilities that exist in the way that Microsoft Excel handles specially crafted Excel files.

  Microsoft has released a security update that addresses the vulnerabilities by correcting how Microsoft Excel parses and validates data when opening specially crafted Excel files.

  This security update is rated Important for all supported editions of Microsoft Excel 2003, Microsoft Excel 2007, Microsoft Excel 2010, Microsoft Office 2008 for Mac, and Microsoft Office for Mac 2011; it is also rated Important for supported versions of Microsoft Excel Viewer and Microsoft Office Compatibility Pack.

  Consequence

  The vulnerabilities could allow remote code execution if a user opens a specially crafted Office file. An attacker who successfully exploits these vulnerabilities could gain the same user rights as the logged-on user.

  Solution

  Patch:
  

  Refer to Microsoft Security Bulletin MS12-076 for further details.

  Workaround:
  1) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or un-trusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

  Impact of workaround #1-
  Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

  2) Microsoft Office File Block policy should be used to block the opening of Office 2003 and earlier documents from unknown or untrusted sources. The following registry scripts can be used to set the File Block policy.

  Impact of workaround #2-
  If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

  3) Set Office File Validation to disable the opening of files that fail validation in Excel 2003 and Excel 2007

  Impact of workaround #3-
  Office File Validation will no longer allow the opening of suspicious files.

  4) Do not open Excel files from untrusted sources

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.