Microsoft security alert.
December 8, 2009
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 12 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Local Security Authority Subsystem Denial of Service Vulnerability (MS09-069)
- Severity
- Critical 4
- Qualys ID
- 90571
- Vendor Reference
- MS09-069
- CVE Reference
- CVE-2009-3675
- CVSS Scores
- Base 6.8 / Temporal 5.3
- Description
-
This security update resolves a privately reported vulnerability in Microsoft Windows and addresses the vulnerability by changing the way that LSASS handles specially crafted requests.
This security update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
The December 2009 Security Updates For Runtimes Are Now Available on the ECE (KB974392)
- Consequence
- The vulnerability could allow a denial of service if a remote, authenticated attacker, while communicating through Internet Protocol security (IPsec), sends a specially crafted ISAKMP message to the Local Security Authority Subsystem Service (LSASS) on an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Refer to Microsoft Security Bulletin MS09-069 for further details.
-
Microsoft Active Directory Federation Services Remote Code Execution Vulnerability (MS09-070)
- Severity
- Urgent 5
- Qualys ID
- 90573
- Vendor Reference
- MS09-070
- CVE Reference
- CVE-2009-2508, CVE-2009-2509
- CVSS Scores
- Base 9 / Temporal 7
- Description
-
Active Directory Federation Services is a standards based Web Single Sign-On (SSO) service. It enables federated identity by implementing claims based authentication across forests. It is part of Windows Server 2003 R2 and later releases of Microsoft's server Operating System as a server role.
A Remote Code Execution vulnerability exists in implementations of Microsoft Active Directory Federation Services on Windows Server 2003, Windows Server 2003 x64 Edition, Windows Server 2008, and Windows Server 2008 x64 Edition.
A spoofing vulnerability in Active Directory Federation Services could allow an attacker to impersonate an authenticated user if the attacker has access to a workstation and Web browser recently used by the targeted user to access a Web site that offers single sign on.CVE-2009-2508
The vulnerability is due to incorrect validation of request headers when an authenticated user connects to an ADFS enabled Web server. An attacker who successfully exploited this vulnerability could take complete control of an affected system.
Microsoft security update corrects the validation that ADFS-enabled Web servers apply to request headers submitted by a Web client. (CVE-2009-2509)
- Consequence
- An attacker who successfully exploits this vulnerability could then perform actions on the IIS server with the same rights as the Worker Process Identity (WPI).
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
Refer to Microsoft Security Bulletin MS09-070 for further details.
-
Microsoft Internet Authentication Service Could Allow Remote Code Execution (MS09-071)
- Severity
- Critical 4
- Qualys ID
- 116750
- Vendor Reference
- MS09-071
- CVE Reference
- CVE-2009-2505, CVE-2009-3677
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
Internet Authentication Service (IAS) is the Microsoft implementation of a Remote Authentication Dial-In User Service.
MS09-071 resolves multiple issues with the IAS service.
- There is a memory corruption issue due to insufficient validation of the Protected Extensible Authentication Protocol (PEAP) authentication requests. (CVE-2009-2505)
- There is a privilege elevation issue due to the IAS does not properly validate an MS-CHAP v2 authentication request. (CVE-2009-3677)
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
The December 2009 Security Updates For Runtimes Are Now Available on the ECE (KB974318)
- Consequence
- An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista and Windows Vista Service Pack 1
Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems
Windows Server 2008 for Itanium-based Systems Service Pack 2
Refer to Microsoft Security Bulletin MS09-071 for further details.
-
Microsoft Internet Explorer Cumulative Security Update (MS09-072 and KB977981)
- Severity
- Critical 4
- Qualys ID
- 90570
- Vendor Reference
- KB977981, MS09-072
- CVE Reference
- CVE-2009-2493, CVE-2009-3671, CVE-2009-3672, CVE-2009-3673, CVE-2009-3674
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Internet Explorer is a Web browser for Microsoft Windows.
A remote code execution vulnerability exists in an ActiveX control built with vulnerable Microsoft Active Template Library (ATL) headers. Components and controls built using ATL could allow the instantiation of arbitrary objects that can bypass related security policy, such as kill bits within Internet Explorer. Therefore, this vulnerability could allow a remote, unauthenticated user to perform remote code execution on an affected system. (CVE-2009-2493).
A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user. (CVE-2009-3671, CVE-2009-3672,CVE-2009-3673,CVE-2009-3674).
A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a dangling pointer in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "getElementsByTagName()" method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious Web page.(CVE-2009-4054)
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
The December 2009 Security Updates For Runtimes Are Now Available on the ECE (KB976325)
Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.For details see: http://www.qualys.com/research/exploits/#MS09-072 - Consequence
- Successfully exploiting this issues will allow remote attackers to execute arbitrary code and gain same user rights as the logged-on user.
- Solution
-
Patch -
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4 (Internet Explorer 5.01 Service Pack 4)
Microsoft Windows 2000 Service Pack 4 (Internet Explorer 6 Service Pack 1)
Windows XP Service Pack 2 and Windows XP Service Pack 3 (Internet Explorer 6)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 Service Pack 2 (Internet Explorer 6)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)
Windows XP Service Pack 2 and Windows XP Service Pack 3 (Internet Explorer 7)
Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 Service Pack 2 (Internet Explorer 7)
Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)
Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)
Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 (Internet Explorer 7)
For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-072.
-
Microsoft WordPad and Office Text Converters Remote Code Execution Vulnerability (MS09-073)
- Severity
- Urgent 5
- Qualys ID
- 90572
- Vendor Reference
- MS09-073
- CVE Reference
- CVE-2009-2506
- CVSS Scores
- Base 9.3 / Temporal 7.3
- Description
-
This security update resolves a privately reported vulnerability in Microsoft WordPad and Microsoft Office text converters and addresses the vulnerability by correcting the way WordPad and the Office Text Converters parse Word 97 documents.
This security update is rated Important for WordPad on all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003. This security update is also rated Important for all supported editions of Microsoft Office Word 2002 and Microsoft Office Word 2003, Microsoft Office Converter Pack, and Microsoft Works 8.5.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
The December 2009 Security Updates For Runtimes Are Now Available on the ECE (KB973904, 975539)
- Consequence
- The vulnerability could allow remote code execution if a specially crafted Word 97 file is opened in WordPad or Microsoft Office Word. An attacker who successfully exploited this vulnerability could gain the same privileges as the user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Service Pack 4
Windows XP Service Pack 2 and Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Microsoft Office XP Service Pack 3 (Microsoft Office Word 2002 Service Pack 3)
Microsoft Office 2003 Service Pack 3 (Microsoft Office Word 2003 Service Pack 3)
Microsoft Office Converter Pack
Refer to Microsoft Security Bulletin MS09-073 for further details.
-
Microsoft Office Project Could Allow Remote Code Execution (MS09-074)
- Severity
- Urgent 5
- Qualys ID
- 110112
- Vendor Reference
- MS09-074
- CVE Reference
- CVE-2009-0102
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Project is a project management software program to assist project managers.
A remote code execution vulnerability exists in the way that Microsoft Office Project handles specially crafted Project files. An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Consequence
- Successful exploitation of this vulnerability allows an attacker to execute arbitrary code and take complete control of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Project 2000 Service Release 1
Microsoft Project 2002 Service Pack 1
Microsoft Office Project 2003 Service Pack 3
Refer to Microsoft Security Bulletin MS09-074 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.24.71-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 90571
- 90573
- 116750
- 90570
- 90572
- 110112
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.