Cloud Platform
Solutions
Subscriptions
Cloud platform apps
Customers
Partners
Community
Support
Company
Login

Microsoft security alert.

November 14, 2017

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Qualys Cloud Platform to protect organizations against 54 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit our blog to see how to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying our FreeScan service.

Vulnerability details

Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Internet Explorer Security Update for November 2017

    Severity
    Urgent 5
    Qualys ID
    100322
    Vendor Reference
    KB4047206, KB4048952, KB4048953, KB4048954, KB4048955, KB4048956, KB4048957, KB4048958, KB4048959
    CVE Reference
    CVE-2017-11791, CVE-2017-11827, CVE-2017-11834, CVE-2017-11837, CVE-2017-11838, CVE-2017-11843, CVE-2017-11846, CVE-2017-11848, CVE-2017-11855, CVE-2017-11856, CVE-2017-11858, CVE-2017-11869
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description
    Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

    Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11).

    The Security Update addresses the vulnerabilities by fixing:

    1) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11791)
    2) The update addresses the vulnerability by modifying how Microsoft Browser handles objects in memory. (CVE-2017-11827)
    3) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11834)
    4) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11837)
    5) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11838)
    6) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11843)
    7) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11846)
    8) The update addresses the vulnerability by changing how page content is handled by Internet Explorer. (CVE-2017-11848)
    9) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11855)
    10) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11856)
    11) The update addresses the vulnerability by modifying how Microsoft Browser handles objects in memory. (CVE-2017-11858)
    12) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11869)

    KB Articles associated with the Update:
    1) 4048957
    2) 4047206
    3) 4048952
    4) 4048958
    5) 4048953
    6) 4048956
    7) 4048954
    8) 4048955
    9) 4048959

    QID Detection Logic (Authenticated):
    Operating Systems: Windows XP Embedded, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for the file version of %windir%\System32\mshtml.dll
    The following KBs are checked:
    The patch version is 8.0.6001.24002(KB4047206)
    The patch version is 9.0.8112.21073 (KB4047206)
    The patch version is 10.0.9200.22297 (KB4047206 or KB4048959)
    The patch version is 11.0.9600.18838 (KB4047206 or KB4048957 or KB4048958)
    The patch version is 11.0.10240.17673 (KB4048956)
    The patch version is 11.0.10586.1232 (KB4048952)
    The patch version is 11.0.14393.1884 (KB4048953)
    The patch version is 11.0.15063.726(KB4048954)
    The patch version is 11.0.16299.64 (KB4048955)

    Consequence
    Successful exploitation of the vulnerability allows:

    1) Remote Code Execution
    3) Information Disclosure

    Solution
    For more information, Customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Windows Adobe Flash Player Security Update for November 2017

    Severity
    Critical 4
    Qualys ID
    100323
    Vendor Reference
    ADV170019
    CVE Reference
    CVE-2017-3112, CVE-2017-3114, CVE-2017-11213, CVE-2017-11215, CVE-2017-11225
    CVSS Scores
    Base 6.8 / Temporal 5
    Description
    This security update resolves vulnerabilities which are described in the Adobe Security Bulletin APSB17-33, if installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 10 Version 1709, Windows 8.1, or Windows RT 8.1.

    QID Detection Logic:
    Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 27.0.0.187.

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and bypass security restrictions to gain access to sensitive information.
    Solution
    Customers are advised to follow ADV170019 for instructions pertaining to the remediation of these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4048951

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update November 2017

    Severity
    Critical 4
    Qualys ID
    110308
    Vendor Reference
    KB2553204, KB3162047, KB4011197, KB4011199, KB4011205, KB4011206, KB4011220, KB4011233, KB4011242, KB4011244, KB4011245, KB4011247, KB4011250, KB4011257, KB4011262, KB4011264, KB4011265, KB4011266, KB4011267, KB4011268, KB4011270, KB4011271, KB4011276
    CVE Reference
    CVE-2017-11854, CVE-2017-11876, CVE-2017-11877, CVE-2017-11878, CVE-2017-11882
    CVSS Scores
    Base 9.3 / Temporal 7.3
    Description
    Microsoft releases security updates on November 2017 to fix following vulnerabilities:

    - A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. (CVE-2017-11854) - An elevation of privilege vulnerability exists in Microsoft Project when Microsoft Project Server does not properly manage user sessions. (CVE-2017-11876) - A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document. (CVE-2017-11877) - A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory.(CVE-2017-11878) - A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory.(CVE-2017-11882)

    This security updates contain following KBs:
    KB2553204 KB3162047 KB4011197 KB4011199 KB4011205 KB4011206 KB4011220 KB4011233 KB4011242 KB4011244 KB4011245 KB4011247 KB4011250 KB4011257 KB4011262 KB4011264 KB4011265 KB4011266 KB4011267 KB4011268 KB4011270 KB4011271 KB4011276

    Consequence
    An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update November 2017

  • Microsoft .NET CORE Denial Of Service Vulnerability

    Severity
    Serious 3
    Qualys ID
    370657
    Vendor Reference
    .NET Core CVE-2017-11770
    CVE Reference
    CVE-2017-11770
    CVSS Scores
    Base 5 / Temporal 3.7
    Description
    .NET Core is a general purpose development platform maintained by Microsoft and the .NET community on GitHub. It is cross-platform, supporting Windows, macOS and Linux, and can be used in device, cloud, and embedded/IoT scenarios.

    A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data.

    Affected versions on Platform Linux:
    .NET Core 1.0.x prior to 1.0.8
    .NET Core 1.1.x prior to 1.1.5
    .NET Core 2.0.0

    Affected versions on Platform MacOS:
    .NET Core 1.0.x prior to 1.0.8
    .NET Core 1.1.x prior to 1.1.5

    Consequence
    An attacker who successfully exploited this vulnerability can cause a denial of service against a .NET Core web application.
    Solution
    Microsoft has released an update. Please refer to vendor security advisory .NET Core CVE-2017-11770 for more information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    .NET Core CVE-2017-11770

  • Microsoft Edge Security Update for November 2017

    Severity
    Urgent 5
    Qualys ID
    91413
    Vendor Reference
    4048952, 4048953, 4048954, 4048955, 4048956
    CVE Reference
    CVE-2017-11791, CVE-2017-11803, CVE-2017-11827, CVE-2017-11833, CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11844, CVE-2017-11845, CVE-2017-11846, CVE-2017-11858, CVE-2017-11861, CVE-2017-11862, CVE-2017-11863, CVE-2017-11866, CVE-2017-11870, CVE-2017-11871, CVE-2017-11872, CVE-2017-11873, CVE-2017-11874
    CVSS Scores
    Base 9.3 / Temporal 7.3
    Description
    Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
    Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the update:
    1) KB4048952
    1) KB4048953
    2) KB4048956
    3) KB4048954
    3) KB4048955

    QID Detection Logic (Authenticated):
    Operating Systems: All versions of Windows 10 and Windows Server 2016
    This QID checks for the file version of %windir%\System32\edgehtml.dll
    The following KBs are checked:
    The patch version is 11.0.10240.17673 (KB4048956)
    The patch version is 11.0.10586.1232(KB4048952)
    The patch version is 11.0.14393.1884 (KB4048953)
    The patch version is 11.0.15063.726(KB4048954)
    The patch version is 11.0.16299.64 (KB4048955)

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

    Solution
    For more information, customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Windows Security Update November 2017

    Severity
    Critical 4
    Qualys ID
    91414
    Vendor Reference
    KB4046184, KB4047211, KB4048952, KB4048953, KB4048954, KB4048955, KB4048956, KB4048957, KB4048958, KB4048959, KB4048960, KB4048961, KB4048962, KB4048968, KB4048970, KB4049164
    CVE Reference
    CVE-2017-11768, CVE-2017-11788, CVE-2017-11830, CVE-2017-11831, CVE-2017-11832, CVE-2017-11835, CVE-2017-11842, CVE-2017-11847, CVE-2017-11849, CVE-2017-11850, CVE-2017-11851, CVE-2017-11852, CVE-2017-11853, CVE-2017-11880
    CVSS Scores
    Base 9.3 / Temporal 7.3
    Description
    Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

    An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory. (CVE-2017-11880.)
    An information disclosure vulnerability exists when the Windows kernel fails to correctly initialize a memory address. An attacker who successfully exploits this vulnerability could obtain information to further compromise the users system.(CVE-2017-11831.)
    A denial of service vulnerability exists when Windows Search improperly handles objects in memory. An attacker who successfully exploits the vulnerability could cause a remote denial of service against a system.(CVE-2017-11788.)
    An information disclosure vulnerability exists in the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts.

    KB Articles associated with the Update:
    KB4048957
    KB4048960
    KB4048958
    KB4048961
    KB4048952
    KB4048959
    KB4048962
    KB4048953
    KB4048956
    KB4048954
    KB4048955
    KB4047211
    KB4046184
    KB4048968
    KB4048970
    KB4049164

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4042723

These new vulnerability checks are included in Qualys vulnerability signature 2.4.195-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 100322
    • 100323
    • 110308
    • 370657
    • 91413
    • 91414
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Qualys Cloud Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.