Microsoft security alert.
January 12, 2016
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 24 vulnerabilities that were fixed in 9 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 9 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Windows Kernel Privilege Escalation Vulnerabilities (MS16-008)
- Severity
- Critical 4
- Qualys ID
- 91149
- Vendor Reference
- MS16-008
- CVE Reference
- CVE-2016-0006, CVE-2016-0007
- CVSS Scores
- Base 6.9 / Temporal 5.7
- Description
-
Multiple vulnerabilities exist in Windows while validating reparse points being set by sandbox applications.
Microsoft has released a security update that addresses the vulnerabilities by correcting how Windows handles certain scenarios involving mount point creation.
This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- An attacker who successfully exploited the vulnerabilities could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Refer to MS16-008 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-008 Windows 10 Version 1511 for 32-bit Systems
MS16-008 Windows 10 Version 1511 for x64-based Systems
MS16-008 Windows 10 for 32-bit Systems
MS16-008 Windows 10 for x64-based Systems
MS16-008 Windows 7 for 32-bit Systems Service Pack 1
MS16-008 Windows 7 for x64-based Systems Service Pack 1
MS16-008 Windows 8 for 32-bit Systems
MS16-008 Windows 8 for x64-based Systems
MS16-008 Windows 8.1 for 32-bit Systems
MS16-008 Windows 8.1 for x64-based Systems
MS16-008 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-008 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-008 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-008 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-008 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-008 Windows Server 2012
MS16-008 Windows Server 2012 R2
MS16-008 Windows Vista Service Pack 2
MS16-008 Windows Vista x64 Edition Service Pack 2
-
Microsoft Exchange Server Address Spoofing Vulnerabilities (MS16-010)
- Severity
- Serious 3
- Qualys ID
- 53002
- Vendor Reference
- MS16-010
- CVE Reference
- CVE-2016-0029, CVE-2016-0030, CVE-2016-0031, CVE-2016-0032
- CVSS Scores
- Base 4.3 / Temporal 3.2
- Description
-
Multiple spoofing vulnerabilities exist in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests.
The security update addresses the vulnerabilities by correcting how Microsoft Exchange OWA validates web requests and by helping to ensure that OWA properly sanitizes user input and email content.
This security update is rated Important for all supported editions of Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016.
- Consequence
- An attacker who successfully exploited the vulnerability could disclosing sensitive information.
- Solution
-
Please refer to MS16-010 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-010 Microsoft Exchange Server 2013 Cumulative Update 10
MS16-010 Microsoft Exchange Server 2013 Cumulative Update 11
MS16-010 Microsoft Exchange Server 2013 Service Pack 1
MS16-010 Microsoft Exchange Server 2016
-
Microsoft Windows Remote Code Execution Vulnerability (MS16-007)
- Severity
- Critical 4
- Qualys ID
- 91151
- Vendor Reference
- MS16-007
- CVE Reference
- CVE-2016-0014, CVE-2016-0015, CVE-2016-0016, CVE-2016-0018, CVE-2016-0019, CVE-2016-0020
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
This security update resolves vulnerabilities in Microsoft Windows.
The security update addresses the vulnerabilities by:
1. Correcting how Windows validates input before loading DLL files,
2. Correcting how Microsoft DirectShow validates user input
3. Enforcing the default setting of not allowing remote logon for accounts without passwords.
This security update is rated Important for all supported releases of Microsoft Windows.
- Consequence
- The most severe of the vulnerabilities could allow remote code execution if an attacker is able to log on to a target system and run a specially crafted application.
- Solution
-
Refer to Microsoft Security Bulletin MS16-007 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-007 Windows 10 Version 1511 for 32-bit Systems
MS16-007 Windows 10 Version 1511 for x64-based Systems
MS16-007 Windows 10 for 32-bit Systems
MS16-007 Windows 10 for x64-based Systems
MS16-007 Windows 7 for 32-bit Systems Service Pack 1
MS16-007 Windows 7 for 32-bit Systems Service Pack 1
MS16-007 Windows 7 for 32-bit Systems Service Pack 1
MS16-007 Windows 7 for 32-bit Systems Service Pack 1
MS16-007 Windows 7 for 32-bit Systems Service Pack 1
MS16-007 Windows 7 for x64-based Systems Service Pack 1
MS16-007 Windows 7 for x64-based Systems Service Pack 1
MS16-007 Windows 7 for x64-based Systems Service Pack 1
MS16-007 Windows 7 for x64-based Systems Service Pack 1
MS16-007 Windows 7 for x64-based Systems Service Pack 1
MS16-007 Windows 8 for 32-bit Systems
MS16-007 Windows 8 for 32-bit Systems
MS16-007 Windows 8 for 32-bit Systems
MS16-007 Windows 8 for 32-bit Systems
MS16-007 Windows 8 for x64-based Systems
MS16-007 Windows 8 for x64-based Systems
MS16-007 Windows 8 for x64-based Systems
MS16-007 Windows 8 for x64-based Systems
MS16-007 Windows 8.1 for 32-bit Systems
MS16-007 Windows 8.1 for 32-bit Systems
MS16-007 Windows 8.1 for 32-bit Systems
MS16-007 Windows 8.1 for 32-bit Systems
MS16-007 Windows 8.1 for x64-based Systems
MS16-007 Windows 8.1 for x64-based Systems
MS16-007 Windows 8.1 for x64-based Systems
MS16-007 Windows 8.1 for x64-based Systems
MS16-007 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-007 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-007 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-007 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-007 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-007 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-007 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-007 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-007 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-007 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-007 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-007 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-007 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-007 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-007 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-007 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-007 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-007 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-007 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-007 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-007 Windows Server 2012
MS16-007 Windows Server 2012
MS16-007 Windows Server 2012
MS16-007 Windows Server 2012 R2
MS16-007 Windows Server 2012 R2
MS16-007 Windows Server 2012 R2
MS16-007 Windows Server 2012 R2
MS16-007 Windows Vista Service Pack 2
MS16-007 Windows Vista Service Pack 2
MS16-007 Windows Vista Service Pack 2
MS16-007 Windows Vista Service Pack 2
MS16-007 Windows Vista x64 Edition Service Pack 2
MS16-007 Windows Vista x64 Edition Service Pack 2
MS16-007 Windows Vista x64 Edition Service Pack 2
MS16-007 Windows Vista x64 Edition Service Pack 2
-
Microsoft Internet Explorer Cumulative Security Update (MS16-001)
- Severity
- Urgent 5
- Qualys ID
- 100273
- Vendor Reference
- MS16-001
- CVE Reference
- CVE-2016-0002, CVE-2016-0005
- CVSS Scores
- Base 7.6 / Temporal 5.6
- Description
-
Microsoft Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.
This security update resolves multiple vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
This security update is rated Critical for Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.
- Consequence
- A remote, unauthenticated attacker could exploit these vulnerabilities to elevate their privileges, execute arbitrary code or cause a denial of service condition on the targeted system.
- Solution
-
Customers are advised to refer to Microsoft Advisory MS16-001 for more details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-001 Windows 10 Version 1511 for 32-bit Systems
MS16-001 Windows 10 Version 1511 for x64-based Systems
MS16-001 Windows 10 for 32-bit Systems
MS16-001 Windows 10 for x64-based Systems
MS16-001 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 10)
MS16-001 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
MS16-001 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 8)
MS16-001 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 9)
MS16-001 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS16-001 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS16-001 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS16-001 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS16-001 Windows 8 for 32-bit Systems(Internet Explorer 10)
MS16-001 Windows 8 for x64-based Systems(Internet Explorer 10)
MS16-001 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
MS16-001 Windows 8.1 for x64-based Systems(Internet Explorer 11)
MS16-001 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1(Internet Explorer 8)
MS16-001 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 10)
MS16-001 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
MS16-001 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 8)
MS16-001 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 9)
MS16-001 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 7)
MS16-001 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 8)
MS16-001 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
MS16-001 Windows Server 2008 for Itanium-based Systems Service Pack 2(Internet Explorer 7)
MS16-001 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 7)
MS16-001 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 8)
MS16-001 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
MS16-001 Windows Server 2012(Internet Explorer 10)
MS16-001 Windows Server 2012 R2(Internet Explorer 11)
MS16-001 Windows Vista Service Pack 2(Internet Explorer 7)
MS16-001 Windows Vista Service Pack 2(Internet Explorer 8)
MS16-001 Windows Vista Service Pack 2(Internet Explorer 9)
MS16-001 Windows Vista x64 Edition Service Pack 2(Internet Explorer 7)
MS16-001 Windows Vista x64 Edition Service Pack 2(Internet Explorer 8)
MS16-001 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)
-
Microsoft Edge Cumulative Security Update (MS16-002)
- Severity
- Critical 4
- Qualys ID
- 91154
- Vendor Reference
- MS16-002
- CVE Reference
- CVE-2016-0003, CVE-2016-0024
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Edge is a web browser developed by Microsoft and included in the company's Windows 10 operating systems, replacing Internet Explorer as the default web browser on all device classes.
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow code execution with elevated privileges if a user views a specially crafted webpage using Microsoft Edge.
This security update is rated critical for Microsoft Edge on Windows 10.
- Consequence
- Successful exploitation allows a remote attacker to elevate their privileges or execute arbitrary code on a targeted system.
- Solution
-
Customers are advised to refer to Microsoft Security Bulletin MS16-002 for details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-002 Windows 10 Version 1511 for 32-bit Systems
MS16-002 Windows 10 Version 1511 for x64-based Systems
MS16-002 Windows 10 for 32-bit Systems
MS16-002 Windows 10 for x64-based Systems
-
Microsoft JScript and VBScript Remote Code Execution Vulnerabilities (MS16-003)
- Severity
- Urgent 5
- Qualys ID
- 91152
- Vendor Reference
- MS16-003
- CVE Reference
- CVE-2016-0002
- CVSS Scores
- Base 7.6 / Temporal 6.3
- Description
-
This security update resolves a vulnerability in the VBScript scripting engine in Microsoft Windows.
A remote code execution vulnerability exists in the way that the VBScript engine renders when handling objects in memory in Internet Explorer. The update addresses the vulnerability by modifying how the VBScript scripting engine handles objects in memory.This security update is rated Critical for affected versions of the VBScript scripting engine on supported editions of Windows Vista, Windows Server 2008, and Server Core installations of Windows Server 2008 R2.
- Consequence
- The vulnerability could allow remote code execution if a user visits a specially crafted website. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.
- Solution
-
Please refer to MS16-003 for details.
Workaround:
The following workarounds may be helpful in your situation:
1. Restrict access to VBScript.dll
For 32-bit systems, enter the following command at an administrative command prompt:
takeown /f %windir%\system32\vbscript.dll
cacls %windir%\system32\vbscript.dll /E /P everyone:N
For 64-bit systems, enter the following command at an administrative command prompt:
takeown /f %windir%\syswow64\vbscript.dll
cacls %windir%\syswow64\vbscript.dll /E /P everyone:N
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-003 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Server Core installation only)(VBScript 5.8)
MS16-003 Windows Server 2008 for 32-bit Systems Service Pack 2(VBScript 5.7)
MS16-003 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)(VBScript 5.7)
MS16-003 Windows Server 2008 for Itanium-based Systems Service Pack 2(VBScript 5.7)
MS16-003 Windows Server 2008 for x64-based Systems Service Pack 2(VBScript 5.7)
MS16-003 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)(VBScript 5.7)
MS16-003 Windows Vista Service Pack 2(VBScript 5.7)
MS16-003 Windows Vista x64 Edition Service Pack 2(VBScript 5.7)
-
Microsoft Office Remote Code Execution Vulnerabilities (MS16-004)
- Severity
- Urgent 5
- Qualys ID
- 110263
- Vendor Reference
- MS16-004
- CVE Reference
- CVE-2015-6117, CVE-2016-0010, CVE-2016-0011, CVE-2016-0012, CVE-2016-0035
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Office is prone to the following vulnerabilities:
- Multiple remote code execution vulnerabilities exist in Microsoft Office software when the Office software fails to properly handle objects in memory.
- Multiple security feature bypasses exist in Microsoft SharePoint when Access Control Policy (ACP) configuration settings are not enforced correctly.
A security feature bypass exists when Microsoft Office fails to use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack.
Microsoft has released a security update that addresses these vulnerabilities by correcting how Microsoft Office handles objects in memory, ensuring that Microsoft SharePoint correctly enforces ACP configuration settings and by helping to ensure that Microsoft Office properly implements the ASLR security feature.
The security update is rated as Critical.
QID Detection Logic (Authenticated):
Operating System: Windows
The detection extracts the Install Path for the affected software mentioned in the advisory via the Windows Registry. The QID checks the file version at these paths to identify vulnerable versions of the affected software.Operating System: MacOS
This QID checks for the vulnerable version of office application (Excel). - Consequence
- The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.
- Solution
-
Refer to MS16-004 for more information.
Microsoft Security Guidance for more details pertaining to this vulnerability.
Microsoft Security Guidance for more details pertaining to this vulnerability.
Microsoft Security Guidance for more details pertaining to this vulnerability.
Microsoft Security Guidance for more details pertaining to this vulnerability.
Microsoft Security Guidance for more details pertaining to this vulnerability.
MacOS Release Notes
Office Click-2-Run and Office 365 Release Notes
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-004 Microsoft Excel 2007 Service Pack 3
MS16-004 Microsoft Office 2007 Service Pack 3
MS16-004 Microsoft Office 2010 Service Pack 2 (32-bit editions)
MS16-004 Microsoft Office 2013 Service Pack 1 (32-bit editions)
MS16-004 Microsoft Office 2016 (32-bit edition)
MS16-004 Microsoft PowerPoint 2016 (32-bit edition)
MS16-004 Microsoft PowerPoint 2016 (64-bit edition)
MS16-004 Microsoft Visio 2010 Service Pack 2 (32-bit editions)
MS16-004 Microsoft Visio 2010 Service Pack 2 (64-bit editions)
MS16-004 Microsoft Visio 2013 Service Pack 1 (32-bit editions)
MS16-004 Microsoft Visio 2013 Service Pack 1 (64-bit editions)
MS16-004 Microsoft Visio 2016 (32-bit edition)
MS16-004 Microsoft Visio 2016 (64-bit edition)
MS16-004 Microsoft Word Viewer
-
Microsoft Windows Kernel-Mode Driver Remote Code Execution Vulnerabilities (MS16-005)
- Severity
- Critical 4
- Qualys ID
- 91150
- Vendor Reference
- MS16-005
- CVE Reference
- CVE-2016-0008, CVE-2016-0009
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Windows Kernel is prone to the following vulnerabilities:
A security feature bypass vulnerability exists in the way that the Windows graphics device interface handles objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization (ASLR) bypass (CVE-2016-0008).
A remote code execution vulnerability exists in the way that Windows handles objects in memory (CVE-2016-0009).
This security update is rated Critical for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2; it is rated Important for all supported editions of Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows 10 Version 1511.
- Consequence
- An attacker who successfully exploited these vulnerabilities can install programs, view, change, or delete data,or create new accounts with full user rights.
- Solution
-
Refer to MS16-005 for more information.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-005 Windows 10 Version 1511 for 32-bit Systems
MS16-005 Windows 10 Version 1511 for x64-based Systems
MS16-005 Windows 10 for 32-bit Systems
MS16-005 Windows 10 for x64-based Systems
MS16-005 Windows 7 for 32-bit Systems Service Pack 1
MS16-005 Windows 7 for 32-bit Systems Service Pack 1
MS16-005 Windows 7 for x64-based Systems Service Pack 1
MS16-005 Windows 7 for x64-based Systems Service Pack 1
MS16-005 Windows 8 for 32-bit Systems
MS16-005 Windows 8 for x64-based Systems
MS16-005 Windows 8.1 for 32-bit Systems
MS16-005 Windows 8.1 for x64-based Systems
MS16-005 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-005 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
MS16-005 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-005 Windows Server 2008 R2 for x64-based Systems Service Pack 1
MS16-005 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-005 Windows Server 2008 for 32-bit Systems Service Pack 2
MS16-005 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-005 Windows Server 2008 for Itanium-based Systems Service Pack 2
MS16-005 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-005 Windows Server 2008 for x64-based Systems Service Pack 2
MS16-005 Windows Server 2012
MS16-005 Windows Server 2012 R2
MS16-005 Windows Vista Service Pack 2
MS16-005 Windows Vista Service Pack 2
MS16-005 Windows Vista x64 Edition Service Pack 2
MS16-005 Windows Vista x64 Edition Service Pack 2
-
Microsoft Silverlight Remote Code Execution Vulnerability (MS16-006)
- Severity
- Urgent 5
- Qualys ID
- 91153
- Vendor Reference
- MS16-006
- CVE Reference
- CVE-2016-0034
- CVSS Scores
- Base 9.3 / Temporal 8.1
- Description
-
A remote code execution vulnerability exists when Microsoft Silverlight decodes strings using a malicious decoder that can return negative offsets that cause Silverlight to replace unsafe object headers with contents provided by an attacker.
Affected Software:
Microsoft Silverlight 5 Developer RuntimeThis security update is rated Critical for all supported editions.
- Consequence
-
Successful exploitation allows attacker to execute arbitrary code.
- Solution
-
Refer to Microsoft Security Bulletin MS16-006 for further details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
MS16-006 Microsoft Silverlight 5
MS16-006 Microsoft Silverlight 5 Developer Runtime
These new vulnerability checks are included in Qualys vulnerability signature 2.3.207-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 91149
- 53002
- 91151
- 100273
- 91154
- 91152
- 110263
- 91150
- 91153
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.