Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 62 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Windows Adobe Flash Player Security Update July 2017

  Severity

  Urgent 5

  Qualys ID

  100314

  Vendor Reference

  KB4025376

  CVE Reference

  CVE-2017-3080, CVE-2017-3099, CVE-2017-3100

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  The update addresses the vulnerabilities which are described in Adobe Security Bulletin APSB17-21, if it's installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 8.1, or Windows RT 8.1.

  QID Detection Logic (Authenticated):
  Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
  This QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx
  The following KBs are checked:
  The patch version of 26.0.0.137 (KB4025376)

  Consequence

  Successful exploitation of the vulnerability will lead to remote code execution, information disclosure and memory address disclosure.

  Solution

  Customers are advised to view ADV170009 for instructions pertaining to the remediation of these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4025376

• Microsoft Internet Explorer Security Update for July 2017

  Severity

  Urgent 5

  Qualys ID

  100315

  Vendor Reference

  KB4025252, KB4025331, KB4025336, KB4025338, KB4025339, KB4025341, KB4025342, KB4025344

  CVE Reference

  CVE-2017-8592, CVE-2017-8594, CVE-2017-8602, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8618

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

  Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11).

  The Security Update addresses the vulnerabilities by fixing:

  1) The update addresses the vulnerability by fixing how Microsoft browser handles redirect requests. (CVE-2017-8592)
  2) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-8594)
  3) The update addresses the vulnerability by fixing how Microsoft browser parse HTTP responses. (CVE-2017-8602)
  4) The update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines objects in memory. (CVE-2017-8606)
  5) The update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines objects in memory. (CVE-2017-8607)
  6) The update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines objects in memory. (CVE-2017-8608)
  7) The update addresses the vulnerability by modifying how VBScript scripting engine handles objects in memory. (CVE-2017-8618)

  KB Articles associated with the Update:

  1)4025341
  2)4025252
  3)4025344
  4)4025336
  5)4025339
  6)4025338
  7)4025342
  8)4025331

  QID Detection Logic (Authenticated):
  Operating Systems: Windows XP Embedded, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
  This QID checks for the file version of %windir%\System32\mshtml.dll
  The following KBs are checked:
  The patch version of 8.0.6001.23962(KB4025252)
  The patch version of 9.0.8112.16918 (KB4025252)
  The patch version of 9.0.8112.21029 (KB4025252)
  The patch version of 10.0.9200.22207 (KB4025252 or KB4025331)
  The patch version of 11.0.9600.18739 (KB4025341 or KB4025252 or KB4025336)
  The patch version of 11.0.10240.17488 (KB4025338)
  The patch version of 11.0.10586.1007 (KB4025344)
  The patch version of 11.0.14393.1478 (KB4025339)
  The patch version of 11.0.15063.483 (KB4025342)

  Consequence

  Successful exploitation of the vulnerability allows:

  1) Remote Code Execution
  2) Spoofing
  3) Security Feature Bypass

  Solution

  For more information, Customers are advised to refer the Security Update Guide.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide

• Microsoft Office and Microsoft Office Services and Web Apps Security Update July 2017

  Severity

  Critical 4

  Qualys ID

  110300

  Vendor Reference

  KB2880514, KB2956078, KB3191833, KB3191894, KB3191897, KB3191902, KB3191907, KB3203459, KB3203468, KB3203469, KB3203477, KB3212224, KB3213537, KB3213544, KB3213545, KB3213555, KB3213559, KB3213624, KB3213640, KB3213643, KB3213657, KB4011052, KB4011078

  CVE Reference

  CVE-2017-0243, CVE-2017-8501, CVE-2017-8502, CVE-2017-8569, CVE-2017-8570, CVE-2017-8571, CVE-2017-8572, CVE-2017-8663

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft releases security updates on July 2017 to fix following vulnerabilities:

  - Microsoft Office Remote Code Execution Vulnerability(CVE-2017-0243). - Microsoft Office Memory Corruption Vulnerability(CVE-2017-8501). - Microsoft Office Memory Corruption Vulnerability(CVE-2017-8502). - SharePoint Server XSS Vulnerability(CVE-2017-8569) - Microsoft Office Remote Code Execution Vulnerability(CVE-2017-8570) This security updates contain following KBs:
  KB2880514
  KB3191833
  KB3191894
  KB3191897
  KB3191902
  KB3191907
  KB3203459
  KB3203468
  KB3203469
  KB3203477
  KB3212224
  KB3213537
  KB3213544
  KB3213545
  KB3213555
  KB3213559
  KB3213624
  KB3213640
  KB3213657
  
  New KBs added in detection for CVE-2017-8571, CVE-2017-8572, CVE-2017-8663 (on 07/27/2017):
  KB4011052
  KB4011078
  KB2956078
  KB3213643
  

  Consequence

  An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB2880514(Microsoft Office 2007)
  KB2956078 32-bit version of Outlook 2010(Microsoft Office 2010)
  KB2956078 64-bit version of Outlook 2010(Microsoft Office 2010)
  KB3191833(Microsoft Office 2007)
  KB3191894(Microsoft Office 2007)
  KB3191897(Microsoft Office 2007)
  KB3191902(SharePoint Server 2010)
  KB3191907 32-bit version of Excel 2010(Microsoft Office 2010)
  KB3191907 64-bit version of Excel 2010(Microsoft Office 2010)
  KB3203459 64-bit version of SharePoint Server 2010(Microsoft Office 2010)
  KB3203468 32-bit version of Office 2010(Microsoft Office 2010)
  KB3203468 64-bit version of Office 2010(Microsoft Office 2010)
  KB3203469(Microsoft Office Web Apps 2010)
  KB3203477 32-bit version of Excel 2016(Microsoft Office 2016)
  KB3203477 64-bit version of Excel 2016(Microsoft Office 2016)
  KB3213537 32-bit version of Excel 2013(Microsoft Office 2013)
  KB3213537 64-bit version of Excel 2013(Microsoft Office 2013)
  KB3213544(Microsoft SharePoint Server 2016)
  KB3213545 32-bit version of Office 2016(Microsoft Office 2016)
  KB3213545 64-bit version of Office 2016(Microsoft Office 2016)
  KB3213555 32-bit version of Office 2013(Microsoft Office 2013)
  KB3213555 64-bit version of Office 2013(Microsoft Office 2013)
  KB3213559(Microsoft SharePoint Server 2013)
  KB3213624 32-bit version of Office 2010(Microsoft Office 2010)
  KB3213624 64-bit version of Office 2010(Microsoft Office 2010)
  KB3213640(Microsoft Office 2010)
  KB3213643 32-bit version of Outlook 2007(Microsoft Office 2007)
  KB4011052 32-bit version of Outlook 2016(Microsoft Office 2016)
  KB4011052 64-bit version of Outlook 2016(Microsoft Office 2016)
  KB4011078 32-bit version of Outlook 2013(Microsoft Office 2013)
  KB4011078 32-bit version of Outlook 2013(Microsoft Office 2013)
  Mac 2011 14.7.6 update(Microsoft Office for Mac 2011)

• Microsoft Windows Exchange Server Update For July 2017

  Severity

  Critical 4

  Qualys ID

  53008

  Vendor Reference

  KB4018588

  CVE Reference

  CVE-2017-8559, CVE-2017-8560, CVE-2017-8621

  CVSS Scores

  Base 5.8 / Temporal 4.3

  Description

  This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow remote code execution in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server.

  KB Articles associated with this update are: 4018588

  QID Detection Logic:
  This authenticated detection works by checking for the existence of the following registry keys:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Exchange 2010\SP3\KB4018588
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Exchange 2013\KB4018588
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Exchange 2013\SP1\KB4018588
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Exchange 2016\KB4018588
  The following files are also checked:
  Exsetup.exe lesser than 15.1.845.36
  Exsetup.exe lesser than 15.0.1293.4
  Exsetup.exe lesser than 15.0.847.55
  Exsetup.exe lesser than 14.3.361.1

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4018588

• Microsoft Windows Security Update July 2017

  Severity

  Urgent 5

  Qualys ID

  91393

  Vendor Reference

  KB4022746, KB4022748, KB4022914, KB4025240, KB4025331, KB4025333, KB4025336, KB4025337, KB4025338, KB4025339, KB4025341, KB4025342, KB4025343, KB4025344, KB4025397, KB4025398, KB4025409, KB4025497, KB4025674, KB4025872, KB4025877, KB4026059, KB4026061, KB4032955, KB4034879

  CVE Reference

  CVE-2017-0071, CVE-2017-0170, CVE-2017-8463, CVE-2017-8467, CVE-2017-8486, CVE-2017-8495, CVE-2017-8543, CVE-2017-8556, CVE-2017-8557, CVE-2017-8561, CVE-2017-8562, CVE-2017-8563, CVE-2017-8564, CVE-2017-8565, CVE-2017-8566, CVE-2017-8573, CVE-2017-8574, CVE-2017-8577, CVE-2017-8578, CVE-2017-8580, CVE-2017-8581, CVE-2017-8582, CVE-2017-8584, CVE-2017-8587, CVE-2017-8588, CVE-2017-8589, CVE-2017-8590, CVE-2017-8592

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Microsoft releases the security update for Windows July 2017

  The KB Articles associated with the update:
  KB4025397
  KB4025341
  KB4025337
  KB4025336
  KB4025333
  KB4025344
  KB4025331
  KB4025343
  KB4025339NOTE: This KB was removed by microsoft, also is superseded by KB4025334 and later
  KB4025338
  KB4025342
  KB4025497
  KB4025877
  KB4022746
  KB4025398
  KB4025409
  KB4022748
  KB4025872
  KB4022914
  KB4025674
  KB4026061
  KB4032955
  KB4026059
  KB4025240
  KB4034879
  NOTE: CVE-2017-8543 only affects Windows 10 Version 1607 and Windows 10 Version 1703 for this QID. QID Detection Logic (Authenticated):
  This QID checks for Windows 2008 SP2 through below registry key
  %windir%\system32\Wdc.dll
  %windir%\System32\browseui.dll
  %windir%\system32\win32k.sys
  %windir%\system32\Kerberos.dll
  %windir%\System32\Msinfo32.exe
  %windir%\System32\Wldap32.dll
  %windir%\System32\drivers\netio.sys
  %windir%\System32\Drivers\Http.sys
  %windir%\System32\Drivers\Ntfs.sys
  %ProgramFiles%\Windows NT\Accessories\wordpad.exe
  %windir%\System32\Query.dll
  %windir%\System32\Clfs.sys
  %windir%\system32\Msxml3.dll
  %windir%\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
  For Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2: %windir%\system32\win32k.sys
  For Windows 10, Server 2016: %windir%\system32\win32kfull.sys
  

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4022746
  KB4022748
  KB4022914
  KB4025240
  KB4025331
  KB4025333
  KB4025336
  KB4025337
  KB4025338
  KB4025339 This KB was removed by microsoft, also is superseded by KB4025334 and later
  KB4025341
  KB4025342
  KB4025343
  KB4025344
  KB4025397
  KB4025398
  KB4025409
  KB4025497
  KB4025674
  KB4025872
  KB4025877
  KB4026059
  KB4026061
  KB4032955

• Microsoft Edge Security Update for July 2017

  Severity

  Critical 4

  Qualys ID

  91394

  Vendor Reference

  KB4025338, KB4025339, KB4025342, KB4025344

  CVE Reference

  CVE-2017-8592, CVE-2017-8595, CVE-2017-8596, CVE-2017-8598, CVE-2017-8599, CVE-2017-8601, CVE-2017-8602, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8606, CVE-2017-8607, CVE-2017-8608, CVE-2017-8609, CVE-2017-8610, CVE-2017-8611, CVE-2017-8617, CVE-2017-8619

  CVSS Scores

  Base 7.6 / Temporal 6

  Description

  Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. Many memory corruption vulnerabilities that lead to RCE have been fixed in the browsers scripting engine. This update also addresses security feature bypass vulnerabilities in CORS redirect restrctions and Same origin policy for HTML elements in other browser windows. Spoofing vulnerabilities in the Edge HTTP parser are also fixed in this update.
  Affected Version:
  Microsoft Edge on all Windows 10 versions and Windows Server 2016 KB Articles associated with the Update:

  1) 4025344
  2) 4025338
  3) 4025339
  4) 4025342
  

  QID Detection Logic (Authenticated):
  Operating Systems: All versions of Windows 10 and Windows Server 2016
  This QID checks for the file version of %windir%\System32\edgehtml.dll
  The following KBs are checked:
  The patch version is 11.0.10586.1007 (KB4025344)
  The patch version is 11.0.14393.1478 (KB4025339)
  The patch version is 11.0.15063.483 (KB4025342)
  The patch version is 11.0.10240.17488 (KB4025338)
  

  Consequence

  Successful exploitation of the vulnerability may allow the attacker to cause:

  1) Remote Code Execution
  2) Spoofing
  3) Security Feature bypass
  

  Solution

  For more information, Customers are advised to refer the Security Update Guide.
  

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Edge Security Update for July 2017 Windows 10 Version 1511 for x86 and x64
  Edge Security Update for July 2017 Windows 10 Version 1607 for x86 and x64
  Edge Security Update for July 2017 Windows 10 Version 1703 for x86 and x64
  Edge Security Update for July 2017 Windows 10 for x86 and x64
  Edge Security Update for July 2017 Windows Server 2016

• Microsoft .NET Framework Security Update July 2017

  Severity

  Serious 3

  Qualys ID

  91395

  Vendor Reference

  KB4025338, KB4025339, KB4025342, KB4025344

  CVE Reference

  CVE-2017-8585

  CVSS Scores

  Base 5 / Temporal 3.7

  Description

  A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests.

  KB4025338,KB4025344,KB4025342,KB4025339 are covered in this QID.

  This security update is rated Important for supported versions of Microsoft .NET Framework.

  Consequence

  An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4025338 Windows 10 Version 1507
  KB4025339 Windows 10 Version 1607
  KB4025342 Windows 10 Version 1703
  KB4025344 Windows 10 Version 1511

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.