Microsoft security alert.

December 12, 2017

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 33 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Windows Adobe Flash Player Security Update for December 2017

    Severity
    Critical 4
    Qualys ID
    100324
    Vendor Reference
    ADV170022
    CVE Reference
    CVE-2017-11305
    CVSS Scores
    Base 4.3 / Temporal 3.2
    Description
    This security update resolves vulnerabilities which are described in the Adobe Security Bulletin APSB17-42, if installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 10 Version 1709, Windows 8.1, or Windows RT 8.1.

    QID Detection Logic:
    Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 28.0.0.126.

    KB Articles associated with this update are: KB4053577

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and bypass security restrictions to gain access to sensitive information.
    Solution
    Customers are advised to follow ADV170022 for instructions pertaining to the remediation of these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4053577

  • Microsoft Internet Explorer Security Update for December 2017

    Severity
    Urgent 5
    Qualys ID
    100325
    Vendor Reference
    KB4052978, KB4053578, KB4053579, KB4053580, KB4053581, KB4054517, KB4054518, KB4054519, KB4054520
    CVE Reference
    CVE-2017-11886, CVE-2017-11887, CVE-2017-11890, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11906, CVE-2017-11907, CVE-2017-11912, CVE-2017-11913, CVE-2017-11919, CVE-2017-11930
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

    Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11).

    The Security Update addresses the vulnerabilities by fixing:

    1) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11886)
    2) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11887)
    3) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11890)
    4) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11894)
    5) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11895)
    6) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11901)
    7) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11903)
    8) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11906)
    9) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11907)
    10) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11912)
    11) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11913)
    12) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11919)
    13) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11919)
    KB Articles associated with the Update:
    1) 4054518
    2) 4052978
    3) 4053578
    4) 4054519
    5) 4053579
    6) 4053581
    7) 4053580
    8) 4054517
    9) 4054520

    QID Detection Logic (Authenticated):
    Operating Systems: Windows XP Embedded, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for the file version of %windir%\System32\mshtml.dll
    The following KBs are checked:
    The patch version is 8.0.6001.24022(KB4052978)
    The patch version is 9.0.8112.21084 (KB4052978)
    The patch version is 10.0.9200.22314 (KB4052978 or KB4054520)
    The patch version is 11.0.9600.18860 (KB4052978 or KB4054518 or KB4054519)
    The patch version is 11.0.10240.17709 (KB4053581)
    The patch version is 11.0.10586.1295(KB4053578)
    The patch version is 11.0.14393.1944 (KB4053579)
    The patch version is 11.0.15063.786(KB4053580)
    The patch version is 11.0.16299.125 (KB4054517)

    Consequence
    Successful exploitation of the vulnerability allows:

    1) Remote Code Execution
    2) Information Disclosure

    Solution
    For more information, Customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Office and Microsoft Office Services Security Update December 2017

    Severity
    Critical 4
    Qualys ID
    110309
    Vendor Reference
    KB4011095, KB4011277, KB4011575, KB4011576, KB4011590, KB4011608, KB4011612, KB4011614
    CVE Reference
    CVE-2017-11934, CVE-2017-11936
    CVSS Scores
    Base 6.5 / Temporal 4.8
    Description
    Microsoft releases security updates on December 2017 to fix following vulnerabilities:

    - An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory. (CVE-2017-11934) - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. (CVE-2017-11936)

    This security updates contain following KBs:
    KB4011095 KB4011277 KB4011575 KB4011576 KB4011590 KB4011608 KB4011612 KB4011614 QID Detection Logic:
    This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

    Consequence
    An attacker who successfully exploited the vulnerability could perform cross-site scripting attacks on affected systems and run script in the security context of the current user.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update December 2017

  • Citrix NetScaler ADC and Gateway TLS Padding Oracle Vulnerability (CTX230238) (ROBOT)

    Severity
    Critical 4
    Qualys ID
    370683
    Vendor Reference
    CTX230238
    CVE Reference
    CVE-2017-17382
    CVSS Scores
    Base 4.3 / Temporal 3.4
    Description
    Citrix NetScaler Application Delivery Controller is an application delivery controller that optimizes enterprise service delivery. Citrix NetScaler Gateway provides secure access control management.

    A vulnerability has been identified in the Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Packet Engine that could allow an attacker to exploit the appliance to decrypt TLS traffic.

    Citrix NetScaler ADC and NetScaler Gateway version 12.0 earlier than build 53.22
    Citrix NetScaler ADC and NetScaler Gateway version 11.1 earlier than build 56.19
    Citrix NetScaler ADC and NetScaler Gateway version 11.0 earlier than build 71.22
    Citrix NetScaler ADC and NetScaler Gateway version 10.5 earlier than build 67.13

    QID Detection Logic(authenticated):
    Detection is flagged if it sees vulnerable Citrix NetScaler version.

    QID Detection Logic(unauthenticated):
    Detection sends GET /epa/epa.html http request and match vulnerable versions in the response.

    Consequence
    Successful exploitation allows an attacker to exploit the appliance to decrypt TLS traffic.
    Solution
    Customers are advised to refer to CTX230238 for information pertaining to remediating this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    CTX230238

  • Microsoft Windows Exchange Server Update For December 2017

    Severity
    Critical 4
    Qualys ID
    53010
    Vendor Reference
    KB4045655
    CVE Reference
    CVE-2017-11932, CVE-2017-11937, CVE-2017-11940
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow elevation of privilege or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server. Microsoft has also released an update for Microsoft Exchange that provides enhanced security as a defense-in-depth measure.

    KB Articles associated with this update are: KB4045655

    Consequence
    Successful exploitation of the vulnerability will lead to privilege escalation or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server.

    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4045655

  • Microsoft Windows Security Update December 2017

    Severity
    Critical 4
    Qualys ID
    91415
    Vendor Reference
    KB4052303, KB4053473, KB4053578, KB4053579, KB4053580, KB4053581, KB4054517, KB4054518, KB4054519, KB4054520, KB4054521, KB4054522, KB4054523
    CVE Reference
    CVE-2017-11885, CVE-2017-11899, CVE-2017-11927
    CVSS Scores
    Base 8.5 / Temporal 6.7
    Description
    Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

    A remote code execution vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could execute code on the target system. (CVE-2017-11885)
    A security feature bypass exists when Device Guard incorrectly validates an untrusted file. An attacker who successfully exploited this vulnerability could make an unsigned file appear to be signed. (CVE-2017-11899)
    An information disclosure vulnerability exists when the Windows its:// protocol handler unnecessarily sends traffic to a remote site in order to determine the zone of a provided URL. (CVE-2017-11927)

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for following file versions %windir%\System32\Win32k.sys.exe for all affected OS ecxcept Windows 2008, Windows 10 and Windows 16:-
    The patch version of 6.1.7601.23963 (KB4054518)
    The patch version of 6.2.9200.22327 (KB4054520)
    The patch version of 6.3.9600.18872 (KB4054519)


    This QID checks for following file versions %windir%\System32\Win32kfull.sys.exe for Windows 10 and Windows 16:- The patch version of 10.0.10240.17709 (KB4053581)
    The patch version of 10.0.10586.1295 (KB4053578)
    The patch version of 10.0.14393.1914 (KB4053579)
    The patch version of 10.0.15063.729 (KB4053580)
    The patch version of 10.0.16299.125 (KB4054517)


    This QID checks for following files and its versions for Windows 2008 SP2:-
    The patch version of %windir%\System32\Itss.dll 6.0.6002.24233 (KB4053473)
    The patch version of %windir%\System32\Iprtrmgr.dll 6.0.6002.24231 (KB4052303)


    This QID checks for following file versions %windir%\System32\Itss.dllfor Windows 2008 Service Pack 2, 2008 R2 Service Pack 1, Windows 7 Service Pack 1, Windows 8.1, Windows 2012:-
    The patch version of 6.1.7601.23948 (KB4054521)
    The patch version of 6.2.9200.22313 (KB4054523)
    The patch version of 6.3.9600.18858 (KB4054522)

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4052303
    KB4053473
    KB4053578
    KB4053579
    KB4053580
    KB4053581
    KB4054517
    KB4054518
    KB4054519
    KB4054520
    KB4054521
    KB4054522
    KB4054523

  • Microsoft Edge Security Update for December 2017

    Severity
    Urgent 5
    Qualys ID
    91416
    Vendor Reference
    KB4053578, KB4053579, KB4053580, KB4053581, KB4054517
    CVE Reference
    CVE-2017-11888, CVE-2017-11889, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11905, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11914, CVE-2017-11918, CVE-2017-11919
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
    Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the update:
    1) KB4053578
    2) KB4053579
    3) KB4053581
    4) KB4053580
    5) KB4054517

    QID Detection Logic (Authenticated):
    Operating Systems: All versions of Windows 10 and Windows Server 2016
    This QID checks for the file version of %windir%\System32\edgehtml.dll
    The following KBs are checked:
    The patch version is 11.0.10240.17709 (KB4053581)
    The patch version is 11.0.10586.1295(KB4053578)
    The patch version is 11.0.14393.1944 (KB4053579)
    The patch version is 11.0.15063.786(KB4053580)
    The patch version is 11.0.16299.125 (KB4054517)

    Consequence
    Successful exploitation of the vulnerability allows:

    1) Remote Code Execution
    2) Information Disclosure

    Solution
    For more information, customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

These new vulnerability checks are included in Qualys vulnerability signature 2.4.215-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 100324
    • 100325
    • 110309
    • 370683
    • 53010
    • 91415
    • 91416
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.