Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 51 vulnerabilities that were fixed in 9 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 9 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Security Update for April 2017

  Severity

  Urgent 5

  Qualys ID

  100309

  Vendor Reference

  Microsoft Security Update Guide

  CVE Reference

  CVE-2017-0201, CVE-2017-0202, CVE-2017-0210

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

  Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Critical for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11).

  The Security Update addresses the vulnerabilities by fixing:

  1) The update addresses the vulnerability by modifying how the JScript and VBScript scripting engines handle objects in memory. (CVE-2017-0201)
  2) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-0202 )
  3) The update addresses the vulnerability by helping to ensure that cross-domain policies are properly enforced in Internet Explorer.(CVE-2017-0210)
  KB Articles associated with the Update:

  1) 4015221
  2) 4015550
  3) 4015217
  4) 4015583
  5) 4015219
  6) 4015551
  7) 4014661

  Consequence

  Successful exploitation of the vulnerability allows:

  1) Remote Code Execution (CVE-2017-0201) and (CVE-2017-0202)
  2) Elevation of Privilege (CVE-2017-0210)

  Solution

  For more information, Customers are advised to refer the Security Update Guide.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Internet Explorer Security Update for April 2017 Monthly Quality Rollup for Windows 8.1 for x64-based Systems
  Internet Explorer Security Update for April 2017 Monthly Quality Rollup for Windows 8.1 for x64-based Systems
  Internet Explorer Security Update for April 2017 Monthly Quality Rollup for Windows Embedded 8
  Internet Explorer Security Update for April 2017 Monthly Quality Rollup for Windows Embedded 8 Standard for x64-based Systems
  Internet Explorer Security Update for April 2017 Monthly Quality Rollup for Windows Server 2012
  Internet Explorer Security Update for April 2017 Monthly Quality Rollup for Windows Server 2012 R2
  Internet Explorer Security Update for April 2017 Windows 10
  Internet Explorer Security Update for April 2017 Windows 10 (for x64-based Systems)
  Internet Explorer Security Update for April 2017 Windows 10 Version 1511
  Internet Explorer Security Update for April 2017 Windows 10 Version 1511 for x64-based System
  Internet Explorer Security Update for April 2017 Windows 10 Version 1607
  Internet Explorer Security Update for April 2017 Windows 10 Version 1607 for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows 10 Version 1703
  Internet Explorer Security Update for April 2017 Windows 10 Version 1703 for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows 7
  Internet Explorer Security Update for April 2017 Windows 7 for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows 8.1
  Internet Explorer Security Update for April 2017 Windows 8.1 for x64-based System
  Internet Explorer Security Update for April 2017 Windows Embedded 8 Standard
  Internet Explorer Security Update for April 2017 Windows Embedded 8 Standard for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows Embedded Standard 7
  Internet Explorer Security Update for April 2017 Windows Embedded Standard 7 for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows Server 2008
  Internet Explorer Security Update for April 2017 Windows Server 2008 R2 for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows Server 2008 for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows Server 2012
  Internet Explorer Security Update for April 2017 Windows Server 2016 for x64-based Systems
  Internet Explorer Security Update for April 2017 Windows Vista
  Internet Explorer Security Update for April 2017 Windows Vista for x64-based Systems
  Microsoft Security Guide Update Windows

• Microsoft Edge Security Update for April 2017

  Severity

  Urgent 5

  Qualys ID

  91354

  Vendor Reference

  Microsoft Security Update Guide

  CVE Reference

  CVE-2017-0093, CVE-2017-0200, CVE-2017-0203, CVE-2017-0205, CVE-2017-0208

  CVSS Scores

  Base 7.6 / Temporal 5.6

  Description

  Microsoft Edge is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

  Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge.
  Affected Version:
  Microsoft Edge on Windows 10 and Windows Server 2016. KB Articles associated with the Update:

  1) 4015219
  2) 4015217
  3) 4015583
  4) 4015221
  

  Consequence

  Successful exploitation of the vulnerability may allow the attacker to cause:

  1) Remote Code Execution
  2) Information Disclosure
  

  Solution

  For more information, Customers are advised to refer the Security Update Guide.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Edge Security Update for April 2017 Windows 10 Version 1511 for x64-based Systems
  Edge Security Update for April 2017 Windows 10 Version 1607
  Edge Security Update for April 2017 Windows 10
  Edge Security Update for April 2017 Windows 10 Version 1511
  Edge Security Update for April 2017 Windows 10 Version 1607 for x64-based Systems
  Edge Security Update for April 2017 Windows 10 Version 1703
  Edge Security Update for April 2017 Windows 10 Version 1703 for x64-based Systems
  Edge Security Update for April 2017 Windows 10 for x64-based Systems
  Edge Security Update for April 2017Edge Security Update for April 2017 Windows Server 2016 for x64-based Systems
  Microsoft Security Update Guide

• Microsoft Windows Security Update April 2017

  Severity

  Urgent 5

  Qualys ID

  91355

  Vendor Reference

  KB3211308, KB3217841, KB4014652, KB4014793, KB4014794, KB4015067, KB4015068, KB4015195, KB4015217, KB4015219, KB4015221, KB4015380, KB4015383, KB4015546, KB4015547, KB4015548, KB4015549, KB4015550, KB4015551, KB4015583

  CVE Reference

  CVE-2013-6629, CVE-2017-0058, CVE-2017-0155, CVE-2017-0156, CVE-2017-0158, CVE-2017-0159, CVE-2017-0162, CVE-2017-0163, CVE-2017-0164, CVE-2017-0165, CVE-2017-0166, CVE-2017-0167, CVE-2017-0168, CVE-2017-0169, CVE-2017-0178, CVE-2017-0179, CVE-2017-0180, CVE-2017-0181, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, CVE-2017-0186, CVE-2017-0188, CVE-2017-0189, CVE-2017-0191, CVE-2017-0192, CVE-2017-0199, CVE-2017-0211

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

  An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. (CVE-2017-0167)
  An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-0168, CVE-2017-0169)
  A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system. (CVE-2017-0178, CVE-2017-0179)
  A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system. (CVE-2017-0180, CVE-2017-0181)
  A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. (CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185)
  ) An information disclosure vulnerability exists within the open-source libjpeg image-processing library where it fails to properly handle objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization (ASLR) bypass. (CVE-2013-6629)
  A Win32k information disclosure vulnerability exists when the win32k component improperly provides kernel information. (CVE-2017-0058)
  An elevation of privilege vulnerability exists in Windows when the Microsoft Graphics Component fails to properly handle objects in memory. (CVE-2017-0155, CVE-2017-0156)
  An elevation of privilege vulnerability exists when LDAP request buffer lengths are improperly calculated. (CVE-2017-0166)
  An information disclosure vulnerability exists in Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle objects in memory. (CVE-2017-0192)
  A remote code execution vulnerability exists in the way that Microsoft Office and WordPad parse specially crafted files. (CVE-2017-0199)
  An elevation of privilege vulnerability exists in Microsoft Windows OLE when it fails an integrity-level check. (CVE-2017-0211)
  

  KB Articles associated with the Update:
  1) 4014652
  2) 4014794
  3) 4015383
  4) 4015549
  5) 4015550
  6) 4015219
  7) 4015551
  8) 4015217
  9) 4015221
  10) 4015583
  11) 4015195
  12) 4015067
  13) 3211308
  14) 4015068
  15) 3217841
  16) 4015380
  17) 4014793
  18) 4015546
  19) 4015547
  20) 4015548
  

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB3211308
  KB3217841
  KB4014652
  KB4014793
  KB4014794
  KB4015067
  KB4015068
  KB4015195
  KB4015217
  KB4015219
  KB4015221
  KB4015380
  KB4015383
  KB4015546
  KB4015547
  KB4015548
  KB4015549
  KB4015550
  KB4015551
  KB4015583

• Microsoft Office and Microsoft Office Services and Web Apps Security Update April 2017

  Severity

  Critical 4

  Qualys ID

  110297

  Vendor Reference

  Microsoft Security Update Guide

  CVE Reference

  CVE-2017-0106, CVE-2017-0194, CVE-2017-0195, CVE-2017-0197, CVE-2017-0199, CVE-2017-0204, CVE-2017-0207

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft releases security updates on April 2017 to fix following vulnerabilities:

  - Microsoft Outlook Remote Code Execution Vulnerability (CVE-2017-0106)
  - Microsoft Office Memory Corruption Vulnerability (CVE-2017-0194)
  - Microsoft Office XSS Elevation of Privilege Vulnerability (CVE-2017-0195)
  - Office DLL Loading Vulnerability (CVE-2017-0197)
  - Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API (CVE-2017-0199)
  - Microsoft Office Security Feature Bypass Vulnerability (CVE-2017-0204)
  - Microsoft Office Spoofing Vulnerability (CVE-2017-0207)

  This security updates contain following KBs:
  KB2589382 KB3101522 KB3118388 KB3127890 KB3127895 KB3141529 KB3141538 KB3172519 KB3178664 KB3178702 KB3178703 KB3178710 KB3178724 KB3178725 KB3191827 KB3191829 KB3191830 KB3191840 KB3191845 KB3191847 KB3212218

  Affected Versions:
  Supported version of Microsoft Office and Microsoft Office Services and Web Apps

  Consequence

  An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

  Solution

  Install the missing KBs from Microsoft.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Office and Microsoft Office Services and Web Apps Security Update April 2017

• Microsoft .NET Framework Security Update April 2017

  Severity

  Urgent 5

  Qualys ID

  91353

  Vendor Reference

  KB4014981, KB4014982, KB4014983, KB4014984, KB4014985, KB4014986, KB4014987, KB4014988, KB4015217, KB4015219, KB4015221, KB4015583

  CVE Reference

  CVE-2017-0160

  CVSS Scores

  Base 7.2 / Temporal 5.6

  Description

  A remote code execution vulnerability exists when the .NET Framework fails to properly validate input before loading libraries (CVE-2017-0160).

  KB 4014981, 4014983, 4015219, 4014982, 4015217, 4015221, 4015583, 4014987 and 4014984 are covered in this QID.

  This security update is rated Critical for supported versions of Microsoft .NET Framework.

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4014981
  KB4014982
  KB4014983
  KB4014984
  KB4014985
  KB4014986
  KB4014987
  KB4014988
  KB4015217
  KB4015219
  KB4015221
  KB4015583

• Microsoft Silverlight 5 Security Update April 2017

  Severity

  Urgent 5

  Qualys ID

  91356

  Vendor Reference

  KB4017094

  CVE Reference

  CVE-2013-6629

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  Microsoft Silverlight is a Web browser plug-in for Windows and Mac OS X that delivers high quality video/audio, animation, and richer Website experiences in popular Web browsers.

  This security update to Silverlight includes fixes outlined in KB 4017094.

  Consequence

  Successful exploitation could allow a remote attacker to gain access to sensitive information on a targeted system.

  Solution

  Customers are advised to view KB4017094 for instructions pertaining to the remediation of these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4017094

• Microsoft Windows Adobe Flash Player Security Update April 2017

  Severity

  Urgent 5

  Qualys ID

  100308

  Vendor Reference

  April Flash Security Update 2017-3447

  CVE Reference

  CVE-2017-3058, CVE-2017-3059, CVE-2017-3060, CVE-2017-3061, CVE-2017-3062, CVE-2017-3063, CVE-2017-3064

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  The update addresses the vulnerabilities which are described in Adobe Security Bulletin APSB17-10, if it's installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 8.1, or Windows RT 8.1.

  Consequence

  Successful exploitation of this vulnerability will allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system.

  Solution

  Customers are advised to view April Flash Security Update 2017-3447 for instructions pertaining to the remediation of these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4018483

• EOL/Obsolete Software: Microsoft Exchange Server 2007 Detected

  Severity

  Urgent 5

  Qualys ID

  105711

  Vendor Reference

  Microsoft Exchange Server 2007 End Of Life

  CVE Reference

  N/A

  CVSS Scores

  Base 7.5 / Temporal 6.4

  Description

  Microsoft Exchange Server 2007 has been detected on the host
  Microsoft ended support for Microsoft Exchange Server 2007 on April 11, 2017 and provides no further support.

  QID detection logic (Authenticated):
  Operating Systems: Windows
  The QID determines that Microsoft Exchange Server 2007 is intalled if the below conditions are satisfied:
  1) Checking the Registry key HKLM\SOFTWARE\Microsoft\Exchange\Setup, value "Services" to see the file <PATH>bin\store.exe exists or not.
  2) Checking the Major Product Version with the Registry key HKLM\SOFTWARE\Microsoft\Exchange\Setup, value "MsiProductMajor", data "8".

  QID detection logic (Unauthenticated):
  The QID determines that Microsoft Exchange Server 2007 is running by sending a GET request to the target and checking if the Response Header contains the X-OWA-Version details.
  Major Version for Microsoft Exchange Server 2007 is 8.

  Consequence

  The system is at high risk of being exposed to security vulnerabilities. Since the vendor no longer provides updates, obsolete software is more vulnerable to viruses and other attacks.

  Solution

  Upgrade to the latest supported Microsoft Exchange Server. For more information refer to Microsoft Exchange.

• EOL/Obsolete Operating System: Microsoft Windows Vista Service Pack 2 (SP2) Detected

  Severity

  Urgent 5

  Qualys ID

  105710

  Vendor Reference

  Windows Vista Life Support Cycle

  CVE Reference

  N/A

  CVSS Scores

  Base 10 / Temporal 8.5

  Description

  The host is running Windows Vista Service Pack 2 .
  Microsoft ended support for Windows Vista Service Pack 2 on April 11, 2017 and provides no further support.

  Consequence

  The system is at high risk of being exposed to security vulnerabilities. Since the vendor no longer provides updates, obsolete software is more vulnerable to viruses and other attacks.

  Solution

  Upgrade to a supported Windows Operating System.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.