Microsoft security alert.

March 13, 2018

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 76 vulnerabilities that were fixed in 9 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 9 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Windows Exchange Server Update For March 2018

    Severity
    Critical 4
    Qualys ID
    53011
    Vendor Reference
    KB4073392, KB4073537
    CVE Reference
    CVE-2018-0924, CVE-2018-0940, CVE-2018-0941
    CVSS Scores
    Base 4.3 / Temporal 3.2
    Description
    This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow elevation of privilege or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server. Microsoft has also released an update for Microsoft Exchange that provides enhanced security as a defense-in-depth measure.

    KB Articles associated with this update are: KB4073392 and KB4073537

    QID Detection Logic:
    File versions of bin\Exsetup.exe file are checked:
    MS Exchange 2010: 14.3.389.0
    MS Exchange 2013 - SP1: 15.0.847.59
    MS Exchange 2013 - CU18 and CU19: 15.0.1347.5, 15.0.1365.3
    MS Exchange 2016 - CU7 and CU8: 15.1.1261.39, 15.1.1415.4

    Consequence
    Successful exploitation of the vulnerability will lead to privilege escalation or spoofing in Microsoft Exchange Server if an attacker sends an email that has a specially crafted attachment to a vulnerable Exchange server.

    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4073392
    KB4073537

  • Microsoft Internet Explorer Security Update for March 2018

    Severity
    Urgent 5
    Qualys ID
    100331
    Vendor Reference
    KB4088776, KB4088779, KB4088782, KB4088786, KB4088787, KB4088875, KB4088876, KB4088877, KB4089187
    CVE Reference
    CVE-2018-0889, CVE-2018-0891, CVE-2018-0927, CVE-2018-0929, CVE-2018-0932, CVE-2018-0935, CVE-2018-0942, CVE-2018-8118
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

    Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11). The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the Update:
    1) 4088875
    2) 4089187
    3) 4088779
    4) 4088876
    5) 4088787
    6) 4088786
    7) 4088782
    8) 4088776
    9) 4088877

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for the file version of %windir%\System32\mshtml.dll
    The following KBs are checked:
    The patch version is 9.0.8112.21200 (KB4089187)
    The patch version is 10.0.9200.22387 (KB4089187 or KB4088877)
    The patch version is 11.0.9600.18953 (KB4088875 or KB4089187 or KB4088876)
    The patch version is 11.0.10240.17797 (KB4088786)
    The patch version is 11.0.10586.1478(KB4088779)
    The patch version is 11.0.14393.2125 (KB4088787)
    The patch version is 11.0.15063.966 (KB4088782)
    The patch version is 11.0.16299.309 (KB4088776)

    Consequence
    Successful exploitation of the vulnerability will lead to:

    1) Remote Code Execution
    2) Information Disclosure
    3) Elevation of Privilege

    Solution
    For more information, Customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update March 2018

    Severity
    Critical 4
    Qualys ID
    110312
    Vendor Reference
    KB3114416, KB4011023, KB4011234, KB4011665, KB4011673, KB4011674, KB4011675, KB4011688, KB4011692, KB4011695, KB4011705, KB4011709, KB4011714, KB4011720, KB4011721, KB4011727, KB4011730, KB4018291, KB4018293, KB4018298, KB4018304, KB4018305, KB4018309
    CVE Reference
    CVE-2018-0903, CVE-2018-0907, CVE-2018-0909, CVE-2018-0910, CVE-2018-0911, CVE-2018-0912, CVE-2018-0913, CVE-2018-0914, CVE-2018-0915, CVE-2018-0916, CVE-2018-0917, CVE-2018-0919, CVE-2018-0921, CVE-2018-0922, CVE-2018-0923, CVE-2018-0944, CVE-2018-0947
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description
    Microsoft releases security updates on March 2018 to fix multiple security vulnerabilities:

    This security updates contain following KBs:
    KB3114416 KB4011234 KB4011665 KB4011673 KB4011674 KB4011675 KB4011688 KB4011692 KB4011695 KB4011705 KB4011709 KB4011714 KB4011720 KB4011721 KB4011727 KB4011730 KB4018291 KB4018293 KB4018298 KB4018304 KB4018305 KB4018309 QID Detection Logic:
    This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

    Consequence
    An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update March 2018(Office)

  • Microsoft .NET CORE Hash Collision Denial Of Service Vulnerability March 2018

    Severity
    Serious 3
    Qualys ID
    370820
    Vendor Reference
    .NET Core CVE-2018-0875
    CVE Reference
    CVE-2018-0875
    CVSS Scores
    Base 5 / Temporal 3.7
    Description
    .NET Core is a general purpose development platform maintained by Microsoft and the .NET community on GitHub. It is cross-platform, supporting Windows, macOS and Linux, and can be used in device, cloud, and embedded/IoT scenarios.

    A denial of service vulnerability exists in the way that .NET Core handles specially crafted requests, causing a hash collision.

    Affected versions:
    .NET Core 1.0.x prior to 1.0.10
    .NET Core 1.1.x prior to 1.1.7
    .NET Core 2.0.x prior to 2.0.6

    QID Detection Logic (Authenticated):
    This QID checks for the existence of vulnerable versions of .net core directories under default locations (/usr/share/dotnet/shared/Microsoft.NETCore.App/, /usr/local/share/dotnet/shared/Microsoft.NETCore.App/).

    Consequence
    An attacker who successfully exploited this vulnerability can cause a denial of service against a .NET Core web application.
    Solution
    Microsoft has released an update. Please refer to vendor security advisory .NET Core CVE-2018-0875 for more information.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    .NET Core CVE-2018-0875

  • Microsoft Windows Adobe Flash Player Security Update for March 2018 (ADV180006)

    Severity
    Urgent 5
    Qualys ID
    100330
    Vendor Reference
    ADV180006
    CVE Reference
    CVE-2018-4919, CVE-2018-4920
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description
    This security update resolves vulnerabilities which are described in the Adobe Security Bulletin APSB18-05, if installed on any supported edition of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows 10 Version 1703, Windows 10 Version 1709, Windows 8.1, or Windows RT 8.1.

    QID Detection Logic:
    Operating Systems: Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This authenticated QID checks for the file version of %windir%\System32\Macromed\Flash\Flash.ocx for file versions lesser than 29.0.0.113.

    KB Articles associated with this update are: ADV180006

    Consequence
    Successful exploitation allows an attacker to execute code remotely.
    Solution
    Customers are advised to follow KB4088785 for instructions pertaining to the remediation of these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4088785

  • Microsoft Edge Security Update for March 2018

    Severity
    Urgent 5
    Qualys ID
    91437
    Vendor Reference
    KB4088776, KB4088779, KB4088782, KB4088786, KB4088787
    CVE Reference
    CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0876, CVE-2018-0879, CVE-2018-0891, CVE-2018-0893, CVE-2018-0927, CVE-2018-0930, CVE-2018-0931, CVE-2018-0932, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, CVE-2018-0937, CVE-2018-0939
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
    Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the update:
    1) KB4088779
    2) KB4088787
    3) KB4088786
    4) KB4088782
    5) KB4088776

    QID Detection Logic (Authenticated):
    Operating Systems: All versions of Windows 10 and Windows Server 2016
    This QID checks for the file version of %windir%\System32\edgehtml.dll
    The following KBs are checked:
    The patch version is 11.0.10240.17797 (KB4088786)
    The patch version is 11.0.10586.1478(KB4088779)
    The patch version is 11.0.14393.2125 (KB4088787)
    The patch version is 11.0.15063.966 (KB4088782)
    The patch version is 11.0.16299.309 (KB4088776)

    Consequence
    Successful exploitation of the vulnerability allows:

    1) Remote Code Execution
    2) Information Disclosure

    Solution
    For more information, customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft ASP.NET Core Multiple Security Vulnerabilities for March 2018

    Severity
    Critical 4
    Qualys ID
    91436
    Vendor Reference
    Announcement 294, Announcement 295
    CVE Reference
    CVE-2018-0787, CVE-2018-0808
    CVSS Scores
    Base 6.8 / Temporal 5
    Description
    Microsoft ASP.NET Core is a free and open-source web framework developed by Microsoft and the community.

    Microsoft ASP.NET Core contains the following vulnerabilities:
    CVE-2018-0787: An elevation of privilege vulnerability exists when a Kestrel web application fails to validate web requests. The security update addresses the vulnerability by correcting how a Kestrel web application validates web requests.
    CVE-2018-0808: A denial of service (DoS) vulnerability exists when ASP.NET Core improperly handles web requests. The update addresses the vulnerability by correcting how the ASP.NET Core web application handles web requests.

    Affected Versions:
    ASP.NET Core versions 2.0.0 through 2.1.3

    QID Detection Logic:
    This authenticated QID checks the 'dotnet.dll' or 'aspnetcore.dll' version to see if it's less than patched versions, 2.0.2.0 for 'dotnet.dll' and '7.1.1990.0' for 'aspnetcore.dll'.

    Consequence
    Depending on the vulnerability exploited, a successful attack allows an unauthenticated remote attacker to conduct HTML injection attacks and execute code with elevated privileges or cause a DoS condition on the targeted system.

    Solution
    Customers are advised to upgrade to ASP.NET Core 2.1.4 or later versions to remediate these vulnerabilities.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    ASP.NET Core 2.1.4 or later

  • Microsoft Windows Security Update March 2018

    Severity
    Critical 4
    Qualys ID
    91435
    Vendor Reference
    KB4056564, KB4073011, KB4087398, KB4088776, KB4088779, KB4088782, KB4088786, KB4088787, KB4088827, KB4088875, KB4088876, KB4088877, KB4088878, KB4088879, KB4088880, KB4089175, KB4089229, KB4089344, KB4089453
    CVE Reference
    CVE-2018-0811, CVE-2018-0813, CVE-2018-0814, CVE-2018-0815, CVE-2018-0816, CVE-2018-0817, CVE-2018-0868, CVE-2018-0877, CVE-2018-0878, CVE-2018-0880, CVE-2018-0881, CVE-2018-0882, CVE-2018-0883, CVE-2018-0884, CVE-2018-0885, CVE-2018-0888, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, CVE-2018-0901, CVE-2018-0902, CVE-2018-0904, CVE-2018-0926, CVE-2018-0977, CVE-2018-0983
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

    An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass. (CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900)
    An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.(CVE-2018-0811,CVE-2018-0813,CVE-2018-0814)
    An elevation of privilege vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. (CVE-2018-0815,CVE-2018-0816)

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for following file versions %windir%\System32\Win32k.sys.exe for all affected OS ecxcept Windows 10 and Windows 16:-
    The patch version of 6.0.6002.24321 (KB4089344)
    The patch version of 6.1.7601.24059 (KB4088875 or KB4088878)
    The patch version of 6.2.9200.22376 (KB4088877 or KB4088880)
    The patch version of 6.3.9600.18954 (KB4088876 or KB4088879)


    This QID checks for following file versions %windir%\System32\Win32kfull.sys.exe for Windows 10 and Windows 16:-
    The patch version of 10.0.10240.17797 (KB4088786)
    The patch version of 10.0.10586.1478 (KB4088779)
    The patch version of 10.0.14393.2125 (KB4088787)
    The patch version of 10.0.15063.966 (KB4088782)
    The patch version of 10.0.16299.309 (KB4088776)


    This QID checks for following files and its versions for Windows 2008 SP2:-
    The patch version of %windir%\System32\Advapi32.dll 6.0.6002.24311 (KB4089229)
    The patch version of %windir%\System32\Msi.dll 4.5.6002.24299 (KB4087398)
    The patch version of %windir%\system32\Msra.exe 6.0.6002.24305 (KB4089453)
    The patch version of %windir%\System32\drivers\Vmms.exe 6.0.6002.24302 (KB4088827)
    The patch version of %windir%\system32\drivers\Vmswitch.sys 6.0.6002.24302 (KB4073011)
    The patch version of %%windir%\winsxs\*\Zipfldr.dll 6.0.6002.24305 (KB4089175)

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4056564
    KB4073011
    KB4087398
    KB4088776
    KB4088779
    KB4088782
    KB4088786
    KB4088787
    KB4088827
    KB4088875
    KB4088876
    KB4088877
    KB4088878
    KB4088879
    KB4088880
    KB4089175
    KB4089229
    KB4089344
    KB4089453

  • Microsoft Windows CredSSP updates for March 2018

    Severity
    Critical 4
    Qualys ID
    91438
    Vendor Reference
    CVE-2018-0886, KB4093492
    CVE Reference
    CVE-2018-0886
    CVSS Scores
    Base 7.6 / Temporal 6
    Description
    Credential Security Support Provider protocol (CredSSP) is an authentication provider that processes authentication requests for other applications.

    A remote code execution vulnerability exists in unpatched versions of CredSSP.

    Affected Windows versions:
    Microsoft Windows 10
    Microsoft Windows 7
    Microsoft Windows 8.1
    Microsoft Windows RT 8.1
    Microsoft Windows Server 2016
    Microsoft Windows Server 2012 including R2
    Microsoft Windows Server 2008 including R2

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for following files for patched version for all affected OS
    Tspkg.dll file for KB4056564, KB4088779, KB4103716
    Win32k.sys file for KB4103712, KB4103718, KB4103725, KB4103715, KB4103726, KB4103730
    win32kfull.sys file for KB4103721, KB4103723, KB4103727, KB4103731

    Consequence
    An attacker who successfully exploits this vulnerability could relay user credentials to execute code on the target system.
    Any application that depends on CredSSP for authentication may be vulnerable to this type of attack.

    Solution
    The security update addresses the vulnerability by correcting how CredSSP validates requests during the authentication process.

    To be fully protected against this vulnerability users must enable Group Policy settings on their systems and update their Remote Desktop clients. Further details can be found at KB4093492.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4093492

These new vulnerability checks are included in Qualys vulnerability signature 2.4.284-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 53011
    • 100331
    • 110312
    • 370820
    • 100330
    • 91437
    • 91436
    • 91435
    • 91438
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.