Microsoft security alert.

September 12, 2017

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 90 vulnerabilities that were fixed in 8 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Lync and Skype for Business Security Update for September 2017

    Severity
    Critical 4
    Qualys ID
    110304
    Vendor Reference
    KB3213568, KB4011040, KB4011107, KB4025865, KB4025866
    CVE Reference
    CVE-2017-8676, CVE-2017-8695, CVE-2017-8696
    CVSS Scores
    Base 7.6 / Temporal 5.6
    Description
    Microsoft released security updates that resolve vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. The following updates were released in September 2017:
    CVE-2017-8676: An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system.
    CVE-2017-8695: An information disclosure vulnerability exists when Windows Uniscribe improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system.
    CVE-2017-8696: A remote code execution vulnerability exists due to the way Windows Uniscribe handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system.

    KB Articles associated with this update:
    3213568, 4011040, 4011107, 4025865, 4025866, 4025867

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and bypass security restrictions to gain access to sensitive information.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB3213568
    KB4011040
    KB4011107
    KB4025865
    KB4025866
    KB4025867

  • Microsoft .NET Framework Security Update September 2017

    Severity
    Urgent 5
    Qualys ID
    91410
    Vendor Reference
    KB4038781, KB4038782, KB4038783, KB4038788, KB4040955, KB4040956, KB4040957, KB4040958, KB4040959, KB4040960, KB4040964, KB4040965, KB4040966, KB4040967, KB4040971, KB4040972, KB4040973, KB4040974, KB4040975, KB4040977, KB4040978, KB4040979, KB4040980, KB4040981, KB4041086
    CVE Reference
    CVE-2017-8759
    CVSS Scores
    Base 9.3 / Temporal 8.1
    Description
    A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input. (CVE-2017-8759)

    KB4038781, KB4038782, KB4038783, KB4038788, KB4040955, KB4040956, KB4040957, KB4040958, KB4040959, KB4040960, KB4040964, KB4040965, KB4040966, KB4040967, KB4040971, KB4040972, KB4040973, KB4040974, KB4040975, KB4040977, KB4040978, KB4040979, KB4040980, KB4040981, KB4041086 are covered in this QID.

    This security update is rated Important for supported versions of Microsoft .NET Framework.

    Consequence
    Successful exploitation allows attacker to execute arbitrary code and compromise the system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4038781
    KB4038782
    KB4038783
    KB4038788
    KB4041083
    KB4041084
    KB4041085
    KB4041086
    KB4041090
    KB4041091
    KB4041092
    KB4041093

  • Microsoft Internet Explorer Security Update for September 2017

    Severity
    Critical 4
    Qualys ID
    100319
    Vendor Reference
    KB4036586, KB4038777, KB4038781, KB4038782, KB4038783, KB4038788, KB4038792, KB4038799
    CVE Reference
    CVE-2016-3326, CVE-2017-8733, CVE-2017-8736, CVE-2017-8741, CVE-2017-8747, CVE-2017-8748, CVE-2017-8749, CVE-2017-8750
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

    Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The Security Update addresses the vulnerabilities by fixing:

    1) The update addresses the vulnerability by fixing how Internet Explorer handles specific HTML content. (CVE-2017-8733)
    2) The update addresses the vulnerability by making sure Microsoft browsers restrict access to certain functionality between the subdomain and the parent domain. (CVE-2017-8736)
    3) The update addresses the vulnerability by fixing how Microsoft browser parse HTTP responses. (CVE-2017-8602)
    4) The update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines objects in memory. (CVE-2017-8741)
    5) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-8747)
    6) The update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines objects in memory. (CVE-2017-8748)
    7) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-8749)
    8) The update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory. (CVE-2017-8750)

    Please note: CVE-2016-3326 affects only Windows 10 Version 1703

    KB Articles associated with the Update:

    1) 4038777
    2) 4036586
    3) 4038783
    4) 4038792
    5) 4038782
    6) 4038781
    7) 4038788
    8) 4038799

    QID Detection Logic (Authenticated):
    Operating Systems: Windows XP Embedded, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for the file version of %windir%\System32\mshtml.dll
    The following KBs are checked:
    The patch version of 8.0.6001.23982(KB4036586)
    The patch version of 9.0.8112.21046 (KB4036586)
    The patch version of 10.0.9200.22248 (KB4036586 or KB4038799)
    The patch version of 11.0.9600.18792 (KB4038777 or KB4036586 or KB4038792)
    The patch version of 11.0.10240.17609 (KB4038781)
    The patch version of 11.0.10586.1106 (KB4038783)
    The patch version of 11.0.14393.1715 (KB4038782)
    The patch version of 11.0.15063.608 (KB4038788)

    Consequence
    Successful exploitation of the vulnerability may allow the attacker to cause:

    1) Remote Code Execution
    2) Information Disclosure
    3) Spoofing

    Solution
    For more information, Customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update September 2017

    Severity
    Critical 4
    Qualys ID
    110303
    Vendor Reference
    KB3114428, KB3128027, KB3128030, KB3141537, KB3191831, KB3203474, KB3212225, KB3213551, KB3213560, KB3213562, KB3213564, KB3213626, KB3213631, KB3213632, KB3213638, KB3213641, KB3213642, KB3213644, KB3213646, KB3213649, KB3213658, KB4011038, KB4011041, KB4011050, KB4011055, KB4011056, KB4011061, KB4011062, KB4011063, KB4011064, KB4011065, KB4011069, KB4011086, KB4011089, KB4011090, KB4011091, KB4011103, KB4011108, KB4011113, KB4011117, KB4011125, KB4011126, KB4011127, KB4011134, KB4025867, KB4025868, KB4025869
    CVE Reference
    CVE-2017-8567, CVE-2017-8629, CVE-2017-8630, CVE-2017-8631, CVE-2017-8632, CVE-2017-8676, CVE-2017-8682, CVE-2017-8695, CVE-2017-8696, CVE-2017-8725, CVE-2017-8742, CVE-2017-8743, CVE-2017-8744, CVE-2017-8745
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft releases security updates on September 2017 to fix following vulnerabilities:

    -Microsoft Office Remote Code Execution (CVE-2017-8567). - Microsoft SharePoint XSS Vulnerability (CVE-2017-8629). - Microsoft Office Memory Corruption Vulnerability (CVE-2017-8630). - Microsoft Office Memory Corruption Vulnerability(CVE-2017-8631). - Microsoft Office Memory Corruption Vulnerability (CVE-2017-8632) - Windows GDI+ Information Disclosure Vulnerability(CVE-2017-8676). - Win32k Graphics Remote Code Execution Vulnerability(CVE-2017-8682). - Graphics Component Information Disclosure Vulnerability(CVE-2017-8695). - Microsoft Graphics Component Remote Code Execution(CVE-2017-8696). - Microsoft Office Publisher Remote Code Execution(CVE-2017-8725). - PowerPoint Remote Code Execution Vulnerability(CVE-2017-8742). - PowerPoint Remote Code Execution Vulnerability(CVE-2017-8743). - Microsoft Office Memory Corruption Vulnerability(CVE-2017-8744). - Microsoft SharePoint Cross Site Scripting Vulnerability(CVE-2017-8745).

    This security updates contain following KBs:
    KB3114428 KB3128027 KB3128030 KB3141537 KB3191831 KB3203474 KB3212225 KB3213551 KB3213560 KB3213562 KB3213564 KB3213626 KB3213631 KB3213632 KB3213638 KB3213641 KB3213642 KB3213644 KB3213646 KB3213649 KB3213658 KB4011038 KB4011041 KB4011050 KB4011055 KB4011056 KB4011061 KB4011062 KB4011063 KB4011064 KB4011065 KB4011069 KB4011086 KB4011089 KB4011090 KB4011091 KB4011103 KB4011108 KB4011113 KB4011117 KB4011125 KB4011126 KB4011127 KB4011134 KB4025867

    Consequence
    An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update September 2017

  • Microsoft Edge Security Update for September 2017

    Severity
    Urgent 5
    Qualys ID
    91409
    Vendor Reference
    KB4038781, KB4038782, KB4038783, KB4038788
    CVE Reference
    CVE-2016-3326, CVE-2017-8529, CVE-2017-8597, CVE-2017-8599, CVE-2017-8643, CVE-2017-8648, CVE-2017-8649, CVE-2017-8660, CVE-2017-8723, CVE-2017-8724, CVE-2017-8728, CVE-2017-8729, CVE-2017-8731, CVE-2017-8734, CVE-2017-8735, CVE-2017-8736, CVE-2017-8737, CVE-2017-8738, CVE-2017-8739, CVE-2017-8740, CVE-2017-8741, CVE-2017-8748, CVE-2017-8750, CVE-2017-8751, CVE-2017-8752, CVE-2017-8753, CVE-2017-8754, CVE-2017-8755, CVE-2017-8756, CVE-2017-8757, CVE-2017-11764, CVE-2017-11766
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
    Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the update:
    1) KB4038781
    2) KB4038782
    3) KB4038783
    4) KB4038788

    Please note: CVE-2016-3326, CVE-2017-8599 affects only Windows 10 Version 1703

    Affected version are Microsoft Edge on all Windows 10 versions and Windows Server 2016.


    Please Note - CVE-2017-8529 required extra steps to be manually applied for being fully patched. Please refer to the FAQ seciton for CVE-2017-8529.

    QID Detection Logic (Authenticated):
    Operating Systems: All versions of Windows 10 and Windows Server 2016
    This QID checks for the file version of %windir%\System32\edgehtml.dll
    The following KBs are checked:
    The patch version of 11.0.10240.17609(KB4038781)
    The patch version of 11.0.10586.1106 (KB4038783)
    The patch version of 11.0.14393.1715 (KB4038782)
    The patch version of 11.0.15063.608 (KB4038788)

    Additionally the QID checks if the required Registry Keys are enabled to fully patch CVE-2017-8529. (See FAQ Section)
    The Registry keys required to be patched are:
    "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PRINT_INFO_DISCLOSURE_FIX" value "iexplore.exe" set to "1".
    "HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_PRINT_INFO_DISCLOSURE_FIX" value "iexplore.exe" set to "1". (64 bit only)

    Note (02/26/2018) : The QID has been updated to check for the additional steps required to enable fix for CVE-2017-8529 even when later updates than September 2017 are applied. This is because the fix for CVE-2017-8529 is disabled by default and needs to be enabled manually even after applying latest updates on affected Operating Systems.

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

    Solution
    For more information, customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4038781 Windows 10(Edge)
    KB4038782 Windows 10, version 1607, Windows Server 2016(Edge)
    KB4038783 Windows 10, version 1511(Edge)
    KB4038788 Windows 10, version 1703(Edge)

  • Microsoft Windows Security Update September 2017

    Severity
    Critical 4
    Qualys ID
    91408
    Vendor Reference
    KB4032201, KB4034786, KB4038777, KB4038779, KB4038781, KB4038782, KB4038783, KB4038786, KB4038788, KB4038792, KB4038793, KB4038799, KB4038874, KB4039038, KB4039266, KB4039325, KB4039384
    CVE Reference
    CVE-2016-0165, CVE-2016-3238, CVE-2016-3376, CVE-2017-0161, CVE-2017-0213, CVE-2017-8628, CVE-2017-8675, CVE-2017-8676, CVE-2017-8677, CVE-2017-8678, CVE-2017-8679, CVE-2017-8680, CVE-2017-8681, CVE-2017-8682, CVE-2017-8683, CVE-2017-8684, CVE-2017-8685, CVE-2017-8686, CVE-2017-8687, CVE-2017-8688, CVE-2017-8692, CVE-2017-8695, CVE-2017-8696, CVE-2017-8699, CVE-2017-8702, CVE-2017-8704, CVE-2017-8706, CVE-2017-8707, CVE-2017-8708, CVE-2017-8709, CVE-2017-8710, CVE-2017-8711, CVE-2017-8712, CVE-2017-8713, CVE-2017-8714, CVE-2017-8716, CVE-2017-8719, CVE-2017-8720, CVE-2017-8728, CVE-2017-8737, CVE-2017-8746, CVE-2017-9417
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

    A remote code execution vulnerability exists when Windows Shell does not properly validate file copy destinations. (CVE-2017-8699)
    A spoofing vulnerability exists in the Microsoft implementation of the Bluetooth stack. An attacker who successfully exploits this vulnerability could perform a man-in-the-middle attack and force a users computer to unknowingly route traffic through the attackers computer. (CVE-2017-8628) (BlueBorne)
    An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, allowing an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass. (CVE-2017-8708)
    An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system.(CVE-2017-8707)
    An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploits this vulnerability could obtain information to further compromise the users system.(CVE-2017-8709).
    An information disclosure vulnerability exists in the Windows System Information Console when it improperly parses XML input that contains a reference to an external entity. An attacker who successfully exploits this vulnerability could read arbitrary files via an XML external entity (XXE) declaration. (CVE-2017-8710)
    A remote code execution vulnerability exists due to the way Windows Uniscribe handles objects in memory. (CVE-2017-8692)
    An information disclosure vulnerability exists when Windows Uniscribe improperly discloses the contents of its memory. (CVE-2017-8695)
    A remote code execution vulnerability exists due to the way Windows Uniscribe handles objects in memory. (CVE-2017-8696)
    A race condition that could lead to a remote code execution vulnerability exists in NetBT Session Services when NetBT fails to maintain certain sequencing requirements. (CVE-2017-0161)
    An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. (CVE-2017-8675)
    An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. (CVE-2017-8676)

    KB Articles associated with the Update:
    KB4038792
    KB4038793
    KB4038799
    KB4038786
    KB4038783
    KB4038782
    KB4038781
    KB4038788
    KB4039384
    KB4038777
    KB4038779
    KB4039266
    KB4034786
    KB4038874
    KB4039325
    KB4032201
    KB4039038

    Please note: CVE-2016-0165, CVE-2016-3376, CVE-2017-0213 affects only Windows 10 Version 1703

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB3034786
    KB4032201
    KB4038777
    KB4038779
    KB4038781
    KB4038782
    KB4038783
    KB4038786
    KB4038788
    KB4038792
    KB4038793
    KB4038799
    KB4038874
    KB4039038
    KB4039266
    KB4039325
    KB4039384

  • Microsoft Windows Exchange Server Update For September 2017

    Severity
    Critical 4
    Qualys ID
    53009
    Vendor Reference
    KB4036108
    CVE Reference
    CVE-2017-8758, CVE-2017-11761
    CVSS Scores
    Base 5 / Temporal 3.7
    Description
    This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability allows elevation of privileges or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server.

    KB Articles associated with this update are: 4036108

    Consequence
    Successful exploitation of the vulnerability will lead to privilege escalation and information disclosure.

    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4036108

  • Microsoft Windows Adobe Flash Player Security Update for September 2017

    Severity
    Critical 4
    Qualys ID
    100318
    Vendor Reference
    ADV170013
    CVE Reference
    CVE-2017-11281, CVE-2017-11282
    CVSS Scores
    Base 7.5 / Temporal 6.2
    Description
    This security update resolves vulnerabilities which are described in the Adobe Security Bulletin APSB17-28, if installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 8.1, or Windows RT 8.1.

    QID Detection Logic:
    Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 27.0.0.130.

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and bypass security restrictions to gain access to sensitive information.
    Solution
    Customers are advised to follow ADV170013 for instructions pertaining to the remediation of these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    ADV170013

These new vulnerability checks are included in Qualys vulnerability signature 2.4.135-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 110304
    • 91410
    • 100319
    • 110303
    • 91409
    • 91408
    • 53009
    • 100318
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.