Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 20 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Multiple Remote Code Execution Vulnerabilities (MS13-021)

  Severity

  Urgent 5

  Qualys ID

  100142

  Vendor Reference

  MS13-021

  CVE Reference

  CVE-2013-0087, CVE-2013-0088, CVE-2013-0089, CVE-2013-0090, CVE-2013-0091, CVE-2013-0092, CVE-2013-0093, CVE-2013-0094, CVE-2013-1288

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.

  The Microsoft Internet Explorer is prone to multiple corrupt use-after-free memory conditions that could allow remote, unauthenticated attackers to execute arbitrary code under the security context of the targeted user. By default, Internet Explorer on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 runs in a restricted Enhanced Security Configuration mode that could mitigate these vulnerabilities.

  The vulnerabilities exist because of improper processing of user inputs by the OnResize, saveHistory, CMarkupBehaviorContext, CCaret, CElement, GetMarkupPtr, onBeforeCopy, removeChild and CTreeNode events.

  Microsoft has released a security update that addresses the vulnerability by modifying the way that Internet Explorer handles objects in memory.

  This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10 on compatible Microsoft Windows operating systems.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  March 2013 Security Updates are on MyOEM for XPe SP3 and Standard 2009 (KB2809289)
  

  Consequence

  The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operates with administrative user rights.

  Solution

  Patch:

  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Internet Explorer 6)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

  Windows XP Service Pack 3 (Internet Explorer 7)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

  Windows Vista Service Pack 2 (Internet Explorer 7)

  Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)

  Windows XP Service Pack 3 (Internet Explorer 8)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 8)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-021.

  Workaround:
  1. Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
  2. Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
  

• Microsoft Silverlight Remote Code Execution Vulnerability (MS13-022)

  Severity

  Urgent 5

  Qualys ID

  90870

  Vendor Reference

  MS13-022

  CVE Reference

  CVE-2013-0074

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft Silverlight is a cross-browser, cross-platform implementation of the Microsoft .NET Framework for building media experiences and rich interactive applications for the web.

  A remote code execution vulnerability exists in Microsoft Silverlight that can allow a specially crafted Silverlight application to access memory in an unsafe manner. The vulnerability is caused by Microsoft Silverlight incorrectly checking a memory pointer when rendering an HTML object. (CVE-2013-0074)

  Affected Software:
  Microsoft Silverlight 5 when installed on Mac
  Microsoft Silverlight 5 Developer Runtime when installed on Mac
  Microsoft Silverlight 5 when installed on all supported releases of Microsoft Windows clients
  Microsoft Silverlight 5 Developer Runtime when installed on all supported releases of Microsoft Windows clients
  Microsoft Silverlight 5 when installed on all supported releases of Microsoft Windows servers
  Microsoft Silverlight 5 Developer Runtime when installed on all supported releases of Microsoft Windows servers

  Consequence

  An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the current user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Silverlight 5

• Microsoft Visio Viewer 2010 Remote Code Execution Vulnerability (MS13-023)

  Severity

  Critical 4

  Qualys ID

  110206

  Vendor Reference

  MS13-023

  CVE Reference

  CVE-2013-0079

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Visio is diagramming software for Microsoft Windows. It uses vector graphics to create diverse diagrams.

  The security update addresses the vulnerability by modifying the way that Microsoft Visio Viewer allocates memory when parsing specially crafted Visio files.
  In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted Visio file to the user and by convincing the user to open the file.
  In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted Visio file that is used to attempt to exploit this vulnerability.

  This security update is rated Critical for all supported editions of Microsoft Visio Viewer 2010

  Consequence

  An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Visio Viewer 2010 Service Pack 1 (32-bit Edition)

  Microsoft Visio Viewer 2010 Service Pack 1 (64-bit Edition)

  Microsoft Visio 2010 Service Pack 1 (32-bit editions)

  Microsoft Visio 2010 Service Pack 1 (64-bit editions)

  Microsoft Office 2010 Filter Pack Service Pack 1 (32-bit version)

  Microsoft Office 2010 Filter Pack Service Pack 1 (64-bit version)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-023.

  Workaround:
  1). Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
  You can help protect against exploitation of this vulnerability by changing your settings for the Internet security zone to block ActiveX controls and Active Scripting. You can do this by setting your browser security to High.

  2). Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
  You can help protect against exploitation of this vulnerability by changing your settings to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

  3). Do not open Office files that you receive from untrusted sources or that you receive unexpectedly from trusted sources
  Do not open Office files that you receive from untrusted sources or that you receive unexpectedly from trusted sources. This vulnerability could be exploited when a user opens a specially crafted file.

• Microsoft SharePoint Privilege Escalation Vulnerability (MS13-024)

  Severity

  Critical 4

  Qualys ID

  110208

  Vendor Reference

  MS13-024

  CVE Reference

  CVE-2013-0080, CVE-2013-0083, CVE-2013-0084, CVE-2013-0085

  CVSS Scores

  Base 7.8 / Temporal 5.8

  Description

  Microsoft SharePoint is prone to multiple vulnerabilities that could allow an attacker to conduct privilege escalation attacks.

  Microsoft has released a security update that addresses the vulnerabilities by correcting the way that Microsoft SharePoint Server validates URLs and user input.

  This security update is rated Critical for all supported editions of Microsoft SharePoint Server 2010 and rated Important for all supported editions of Microsoft SharePoint Foundation 2010.

  Consequence

  Exploitation could result in elevation of privilege or information disclosure.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft SharePoint Foundation 2010 (KB2687418)

  SharePoint Server 2010 Service Pack 1 (KB2553407)

  Refer to Microsoft Security Bulletin MS13-024 for further details.

• Microsoft OneNote Information Disclosure Vulnerability (MS13-025)

  Severity

  Critical 4

  Qualys ID

  110207

  Vendor Reference

  MS13-025

  CVE Reference

  CVE-2013-0086

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  Microsoft OneNote 2010 is a digital notebook that provides people with one place to gather their notes and information, powerful search capability to find what they are looking for quickly, and easy-to-use shared notebooks so that they can manage information overload and work together more effectively.

  Microsoft OneNote is prone to a vulnerability that is caused by a buffer size validation issue that allows an attacker to read arbitrary data in memory.

  Microsoft has released a security update that addresses the vulnerability by modifying how Microsoft OneNote checks the size of a buffer to be allocated.

  This security update is rated Important for all supported editions of Microsoft OneNote 2010.

  Consequence

  An attacker who successfully exploited this vulnerability could discover sensitive information, such as the username and password for configured accounts.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft OneNote 2010 Service Pack 1 (32-bit editions)

  Microsoft OneNote 2010 Service Pack 1 (64-bit editions)

  Refer to Microsoft Security Bulletin MS13-025 for further details.

• Microsoft Office Outlook for Mac Information Disclosure (MS13-026)

  Severity

  Serious 3

  Qualys ID

  110205

  Vendor Reference

  MS13-026

  CVE Reference

  CVE-2013-0095

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  Microsoft Outlook is a personal information manager. The application consolidates e-mail and calendar schedules.

  An information disclosure vulnerability exists in the way that Microsoft Outlook for Mac 2008 and Microsoft Outlook for Mac 2011 load specific content tags in an HTML5 email message.

  This security update is rated Important

  Affected Versions:
  Microsoft Office 2008 for Mac
  Microsoft Office 2011 for Mac
  

  Consequence

  An attacker may be able to exploit this issue to gain access to potentially sensitive information that may aid in further attacks.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2008 for Mac

  Microsoft Office for Mac 2011

  Refer to Microsoft Security Bulletin MS13-026 for further details.

• Microsoft Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (MS13-027)

  Severity

  Urgent 5

  Qualys ID

  90871

  Vendor Reference

  MS13-027

  CVE Reference

  CVE-2013-1285, CVE-2013-1286, CVE-2013-1287

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  The Windows kernel is the core of the operating system. The kernel provides system-level services such as device management and memory management, allocates processor time to processes and manages error handling.

  Usb8023.sys is a kernel-mode USB device driver and is the kernel part of the Windows subsystem.
  Elevation of privilege vulnerabilities exist in USB descriptor when the Windows kernel-mode driver improperly handles objects in memory.

  The security update addresses the vulnerabilities by correcting the way that the Windows kernel-mode driver handles objects in memory.

  This security update is rated Important for supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8 and Windows Server 2012.
  Windows RT is not affected by this issue.
  

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  March 2013 Security Updates are on MyOEM for XPe SP3 and Standard 2009 (KB2807986)
  

  Consequence

  Successfully exploiting these vulnerabilities might allow a local user to gain escalated privileges.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems

  Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for Itanium-based Systems

  Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  Windows 8 for 32-bit Systems

  Windows 8 for 64-bit Systems

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-027.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.