Microsoft security alert.
April 10, 2012
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 11 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Internet Explorer Cumulative Security Update (MS12-023)
- Severity
- Urgent 5
- Qualys ID
- 100113
- Vendor Reference
- MS12-023
- CVE Reference
- CVE-2012-0168, CVE-2012-0169, CVE-2012-0170, CVE-2012-0171, CVE-2012-0172
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Internet Explorer is a Web browser available for Microsoft Windows.
Internet Explorer is prone to multiple vulnerabilities that could allow remote code execution.
Microsoft has released a security update that addresses the vulnerabilities by modifying the way Internet Explorer handles the printing of specially crafted HTML content and the way Internet Explorer handles objects in memory.
This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8 and Internet Explorer 9 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8 and Internet Explorer 9 on Windows servers.
Note: Previously this was an iDefense exclusive vulnerability with iDefense ID: 684425.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
April 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2675157)
- Consequence
- The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Internet Explorer 6)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 Service Pack 2 (Internet Explorer 6)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 Service Pack 2 (Internet Explorer 7)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)
Windows Vista Service Pack 2 (Internet Explorer 7)
Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)
Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)
Windows XP Service Pack 3 (Internet Explorer 8)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-023.
Workaround:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
Impact of workaround #1 and #2: On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently.
-
Microsoft Windows Remote Code Execution Vulnerability (MS12-024)
- Severity
- Urgent 5
- Qualys ID
- 90792
- Vendor Reference
- MS12-024
- CVE Reference
- CVE-2012-0151
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
A remote code execution vulnerability exists in Microsoft Windows. The vulnerability occurs when the Windows Authenticode Signature Verification function improperly validates the file digest of a specially crafted PE file (CVE-2012-0151).
The vulnerability could allow remote code execution if a user or application runs or installs a specially crafted, signed portable executable file on an affected system.
This security update is rated Critical for all supported releases of Microsoft Windows.
Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
April 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2653956)
- Consequence
- An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Refer to Microsoft Security Bulletin MS12-024 for further details.
-
Microsoft Forefront Unified Access Gateway Information Disclosure Vulnerability (MS12-026)
- Severity
- Serious 3
- Qualys ID
- 90790
- Vendor Reference
- MS12-026
- CVE Reference
- CVE-2012-0146, CVE-2012-0147
- CVSS Scores
- Base 5.8 / Temporal 4.3
- Description
-
Microsoft Forefront Unified Access Gateway (UAG) is a reverse proxy and VPN solution that provides secure remote access to corporate networks for remote employees and business partners.
A spoofing vulnerability exists in Forefront Unified Access Gateway (UAG) that could lead to information disclosure. The vulnerability could allow spoofing by redirecting web traffic intended for the UAG server to a malicious website (CVE-2012-0146).
A vulnerability exists in Microsoft Unified Access Gateway (UAG) that could allow an unauthenticated user to access the default website of the Microsoft UAG server from the external network (CVE-2012-0147).
This security update is rated Important for Microsoft Forefront Unified Access Gateway 2010 Service Pack 1 and Microsoft Forefront Unified Access Gateway 2010 Service Pack 1 Update 1.
- Consequence
- Successfully exploiting these vulnerabilities might allow a remote attacker to gain access to sensitive information.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Forefront Unified Access Gateway 2010 Service Pack 1
Microsoft Forefront Unified Access Gateway 2010 Service Pack 1 Update 1
Refer to Microsoft Security Bulletin MS12-026 for further details.
-
Microsoft Windows Common Controls Remote Code Execution Vulnerability (MS12-027)
- Severity
- Urgent 5
- Qualys ID
- 90793
- Vendor Reference
- MS12-027
- CVE Reference
- CVE-2012-0158
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Windows Common Controls are ActiveX controls contained in the MSCOMCTL.OCX file.
A remote code execution vulnerability exists in the Windows common controls. The vulnerability occurs when the ActiveX controls, while being used in Internet Explorer, corrupts the system state in such a way as to allow an attacker to execute arbitrary code. (CVE-2012-0158)
Affected Software:
Microsoft Office 2003 Service Pack 3
Microsoft Office 2003 Web Components Service Pack 3
Microsoft Office 2007 Service Pack 2
Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 (32-bit editions)
Microsoft Office 2010 Service Pack 1 (32-bit editions)
Microsoft SQL Server 2000 Analysis Services Service Pack 4
Microsoft SQL Server 2000 Service Pack 4
Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4
Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4
Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4
Microsoft SQL Server 2005 for x64-based Systems Service Pack 4
Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2
Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3
Microsoft SQL Server 2008 for x64-based Systems Service Pack 2
Microsoft SQL Server 2008 for x64-based Systems Service Pack 3
Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2
Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3
Microsoft SQL Server 2008 R2 for 32-bit Systems
Microsoft SQL Server 2008 R2 for x64-based Systems
Microsoft SQL Server 2008 R2 for Itanium-based Systems
Microsoft BizTalk Server 2002 Service Pack 1
Microsoft Commerce Server 2002 Service Pack 4
Microsoft Commerce Server 2007 Service Pack 2
Microsoft Commerce Server 2009
Microsoft Commerce Server 2009 R2
Microsoft Visual FoxPro 8.0 Service Pack 1
Microsoft Visual FoxPro 9.0 Service Pack 2
Visual Basic 6.0 RuntimeThis security update is rated Critical.
- Consequence
- An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2003 Service Pack 3
Microsoft Office 2003 Web Components Service Pack 3
Microsoft Office 2007 Service Pack 2
Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 (32-bit editions)
Microsoft Office 2010 Service Pack 1 (32-bit editions)
Microsoft SQL Server 2000 Analysis Services Service Pack 4
Microsoft SQL Server 2000 Service Pack 4
Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4
Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4
Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4
Microsoft SQL Server 2005 for x64-based Systems Service Pack 4
Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2
Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3
Microsoft SQL Server 2008 for x64-based Systems Service Pack 2
Microsoft SQL Server 2008 for x64-based Systems Service Pack 3
Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2
Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3
Microsoft SQL Server 2008 R2 for 32-bit Systems
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-027.
-
Microsoft Office Remote Code Execution Vulnerability (MS12-028)
- Severity
- Critical 4
- Qualys ID
- 110179
- Vendor Reference
- MS12-028
- CVE Reference
- CVE-2012-0177
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
A remote code execution vulnerability exists in Microsoft Office Works File Converter. The Microsoft Works converter does not properly validate the .wps file format when parsing crafted files.
Microsoft has released a security update that addresses the vulnerability by correcting the Microsoft Works converter.
Affected Software:
Microsoft Office 2007 Service Pack 2
Microsoft Works 9
Microsoft Works 6-9 File Converter
This security update is rated Important.
- Consequence
- The vulnerability could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploits this vulnerability could gain the same user rights as the logged-on user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2007 Service Pack 2
Microsoft Works 6-9 File Converter
Refer to Microsoft Security Bulletin MS12-028 for further details.
Workaround:
Do not open untrusted office files.
-
Microsoft .NET Framework Remote Code Execution Vulnerability (MS12-025)
- Severity
- Critical 4
- Qualys ID
- 90757
- Vendor Reference
- MS12-025
- CVE Reference
- CVE-2012-0163
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
The .NET Framework is a software library used to provide a language agnostic software framework on the Windows platform.
ASP.NET is a Web application framework developed and marketed by Microsoft.This security update resolves one privately reported vulnerability in Microsoft .NET Framework and addresses the vulnerability by correcting the manner in which the Microsoft .NET Framework validates parameters when passing data to a function.
The vulnerability could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs).
The vulnerability could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and then executes the page, as could be the case in a web hosting scenario.
This vulnerability could also be used by Windows .NET applications to bypass Code Access Security (CAS) restrictions. In a web browsing attack scenario, an attacker could host a website that contains a webpage that is used to exploit this vulnerability.Affected Versions:-
Microsoft .NET Framework 1.0 Service Pack 3, Microsoft .NET Framework 1.1 Service Pack 1, Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5.1, and Microsoft .NET Framework 4 on all supported editions of Microsoft Windows.
This security update is rated Critical.Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
April 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2656368, 2656369)
June 2012 Security Updates are Live on ECE for XPe and Standard 2009 (KB2656368, 2656369)
- Consequence
- Successfully exploiting this vulnerability could allow remote code execution on a client system. The compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Service Pack 3 (Microsoft .NET Framework 1.0 Service Pack 3)
Windows XP Service Pack 3 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Service Pack 3 (Microsoft .NET Framework 4)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 1.1 Service Pack 1)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 1.1 Service Pack 1)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 2.0 Service Pack 2)
Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 4)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS12-025.
These new vulnerability checks are included in Qualys vulnerability signature 2.2.96-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 100113
- 90792
- 90790
- 90793
- 110179
- 90757
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.