Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 33 vulnerabilities that were fixed in 7 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 7 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Windows Adobe Flash Player Security Update for December 2017

  Severity

  Critical 4

  Qualys ID

  100324

  Vendor Reference

  ADV170022

  CVE Reference

  CVE-2017-11305

  CVSS Scores

  Base 4.3 / Temporal 3.2

  Description

  This security update resolves vulnerabilities which are described in the Adobe Security Bulletin APSB17-42, if installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 10 Version 1709, Windows 8.1, or Windows RT 8.1.

  QID Detection Logic:
  Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
  This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 28.0.0.126.

  KB Articles associated with this update are: KB4053577

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and bypass security restrictions to gain access to sensitive information.

  Solution

  Customers are advised to follow ADV170022 for instructions pertaining to the remediation of these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4053577

• Microsoft Internet Explorer Security Update for December 2017

  Severity

  Urgent 5

  Qualys ID

  100325

  Vendor Reference

  KB4052978, KB4053578, KB4053579, KB4053580, KB4053581, KB4054517, KB4054518, KB4054519, KB4054520

  CVE Reference

  CVE-2017-11886, CVE-2017-11887, CVE-2017-11890, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11906, CVE-2017-11907, CVE-2017-11912, CVE-2017-11913, CVE-2017-11919, CVE-2017-11930

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

  Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11).

  The Security Update addresses the vulnerabilities by fixing:

  1) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11886)
  2) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11887)
  3) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11890)
  4) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11894)
  5) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11895)
  6) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11901)
  7) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11903)
  8) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11906)
  9) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11907)
  10) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11912)
  11) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2017-11913)
  12) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11919)
  13) The update addresses the vulnerability by modifying how the scripting engines objects in memory. (CVE-2017-11919)
  KB Articles associated with the Update:
  1) 4054518
  2) 4052978
  3) 4053578
  4) 4054519
  5) 4053579
  6) 4053581
  7) 4053580
  8) 4054517
  9) 4054520

  QID Detection Logic (Authenticated):
  Operating Systems: Windows XP Embedded, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
  This QID checks for the file version of %windir%\System32\mshtml.dll
  The following KBs are checked:
  The patch version is 8.0.6001.24022(KB4052978)
  The patch version is 9.0.8112.21084 (KB4052978)
  The patch version is 10.0.9200.22314 (KB4052978 or KB4054520)
  The patch version is 11.0.9600.18860 (KB4052978 or KB4054518 or KB4054519)
  The patch version is 11.0.10240.17709 (KB4053581)
  The patch version is 11.0.10586.1295(KB4053578)
  The patch version is 11.0.14393.1944 (KB4053579)
  The patch version is 11.0.15063.786(KB4053580)
  The patch version is 11.0.16299.125 (KB4054517)
  

  Consequence

  Successful exploitation of the vulnerability allows:

  1) Remote Code Execution
  2) Information Disclosure

  Solution

  For more information, Customers are advised to refer the Security Update Guide.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide

• Microsoft Office and Microsoft Office Services Security Update December 2017

  Severity

  Critical 4

  Qualys ID

  110309

  Vendor Reference

  KB4011095, KB4011277, KB4011575, KB4011576, KB4011590, KB4011608, KB4011612, KB4011614

  CVE Reference

  CVE-2017-11934, CVE-2017-11936

  CVSS Scores

  Base 6.5 / Temporal 4.8

  Description

  Microsoft releases security updates on December 2017 to fix following vulnerabilities:

  - An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory. (CVE-2017-11934) - An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. (CVE-2017-11936)

  This security updates contain following KBs:
  KB4011095 KB4011277 KB4011575 KB4011576 KB4011590 KB4011608 KB4011612 KB4011614 QID Detection Logic:
  This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

  Consequence

  An attacker who successfully exploited the vulnerability could perform cross-site scripting attacks on affected systems and run script in the security context of the current user.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Office and Microsoft Office Services and Web Apps Security Update December 2017

• Citrix NetScaler ADC and Gateway TLS Padding Oracle Vulnerability (CTX230238) (ROBOT)

  Severity

  Critical 4

  Qualys ID

  370683

  Vendor Reference

  CTX230238

  CVE Reference

  CVE-2017-17382

  CVSS Scores

  Base 4.3 / Temporal 3.4

  Description

  Citrix NetScaler Application Delivery Controller is an application delivery controller that optimizes enterprise service delivery. Citrix NetScaler Gateway provides secure access control management.

  A vulnerability has been identified in the Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway Packet Engine that could allow an attacker to exploit the appliance to decrypt TLS traffic.

  Citrix NetScaler ADC and NetScaler Gateway version 12.0 earlier than build 53.22
  Citrix NetScaler ADC and NetScaler Gateway version 11.1 earlier than build 56.19
  Citrix NetScaler ADC and NetScaler Gateway version 11.0 earlier than build 71.22
  Citrix NetScaler ADC and NetScaler Gateway version 10.5 earlier than build 67.13

  QID Detection Logic(authenticated):
  Detection is flagged if it sees vulnerable Citrix NetScaler version.

  QID Detection Logic(unauthenticated):
  Detection sends GET /epa/epa.html http request and match vulnerable versions in the response.

  Consequence

  Successful exploitation allows an attacker to exploit the appliance to decrypt TLS traffic.

  Solution

  Customers are advised to refer to CTX230238 for information pertaining to remediating this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  CTX230238

• Microsoft Windows Exchange Server Update For December 2017

  Severity

  Critical 4

  Qualys ID

  53010

  Vendor Reference

  KB4045655

  CVE Reference

  CVE-2017-11932, CVE-2017-11937, CVE-2017-11940

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow elevation of privilege or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server. Microsoft has also released an update for Microsoft Exchange that provides enhanced security as a defense-in-depth measure.

  KB Articles associated with this update are: KB4045655

  Consequence

  Successful exploitation of the vulnerability will lead to privilege escalation or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4045655

• Microsoft Windows Security Update December 2017

  Severity

  Critical 4

  Qualys ID

  91415

  Vendor Reference

  KB4052303, KB4053473, KB4053578, KB4053579, KB4053580, KB4053581, KB4054517, KB4054518, KB4054519, KB4054520, KB4054521, KB4054522, KB4054523

  CVE Reference

  CVE-2017-11885, CVE-2017-11899, CVE-2017-11927

  CVSS Scores

  Base 8.5 / Temporal 6.7

  Description

  Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

  A remote code execution vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could execute code on the target system. (CVE-2017-11885)
  A security feature bypass exists when Device Guard incorrectly validates an untrusted file. An attacker who successfully exploited this vulnerability could make an unsigned file appear to be signed. (CVE-2017-11899)
  An information disclosure vulnerability exists when the Windows its:// protocol handler unnecessarily sends traffic to a remote site in order to determine the zone of a provided URL. (CVE-2017-11927)
  

  QID Detection Logic (Authenticated):
  Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
  This QID checks for following file versions %windir%\System32\Win32k.sys.exe for all affected OS ecxcept Windows 2008, Windows 10 and Windows 16:-
  The patch version of 6.1.7601.23963 (KB4054518)
  The patch version of 6.2.9200.22327 (KB4054520)
  The patch version of 6.3.9600.18872 (KB4054519)
  
  
  This QID checks for following file versions %windir%\System32\Win32kfull.sys.exe for Windows 10 and Windows 16:- The patch version of 10.0.10240.17709 (KB4053581)
  The patch version of 10.0.10586.1295 (KB4053578)
  The patch version of 10.0.14393.1914 (KB4053579)
  The patch version of 10.0.15063.729 (KB4053580)
  The patch version of 10.0.16299.125 (KB4054517)
  
  
  This QID checks for following files and its versions for Windows 2008 SP2:-
  The patch version of %windir%\System32\Itss.dll 6.0.6002.24233 (KB4053473)
  The patch version of %windir%\System32\Iprtrmgr.dll 6.0.6002.24231 (KB4052303)
  
  
  This QID checks for following file versions %windir%\System32\Itss.dllfor Windows 2008 Service Pack 2, 2008 R2 Service Pack 1, Windows 7 Service Pack 1, Windows 8.1, Windows 2012:-
  The patch version of 6.1.7601.23948 (KB4054521)
  The patch version of 6.2.9200.22313 (KB4054523)
  The patch version of 6.3.9600.18858 (KB4054522)
  

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.

  Solution

  Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  KB4052303
  KB4053473
  KB4053578
  KB4053579
  KB4053580
  KB4053581
  KB4054517
  KB4054518
  KB4054519
  KB4054520
  KB4054521
  KB4054522
  KB4054523

• Microsoft Edge Security Update for December 2017

  Severity

  Urgent 5

  Qualys ID

  91416

  Vendor Reference

  KB4053578, KB4053579, KB4053580, KB4053581, KB4054517

  CVE Reference

  CVE-2017-11888, CVE-2017-11889, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11905, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11914, CVE-2017-11918, CVE-2017-11919

  CVSS Scores

  Base 7.6 / Temporal 6.3

  Description

  Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
  Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

  KB Articles associated with the update:
  1) KB4053578
  2) KB4053579
  3) KB4053581
  4) KB4053580
  5) KB4054517
  

  QID Detection Logic (Authenticated):
  Operating Systems: All versions of Windows 10 and Windows Server 2016
  This QID checks for the file version of %windir%\System32\edgehtml.dll
  The following KBs are checked:
  The patch version is 11.0.10240.17709 (KB4053581)
  The patch version is 11.0.10586.1295(KB4053578)
  The patch version is 11.0.14393.1944 (KB4053579)
  The patch version is 11.0.15063.786(KB4053580)
  The patch version is 11.0.16299.125 (KB4054517)
  

  Consequence

  Successful exploitation of the vulnerability allows:

  1) Remote Code Execution
  2) Information Disclosure

  Solution

  For more information, customers are advised to refer the Security Update Guide.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  Microsoft Security Update Guide

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.