Microsoft security alert.
July 10, 2007
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 12 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Excel Could Allow Remote Code Execution Vulnerabilities (MS07-036)
- Severity
- Urgent 5
- Qualys ID
- 110062
- Vendor Reference
- MS07-036
- CVE Reference
- CVE-2007-1756, CVE-2007-3029, CVE-2007-3030
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Microsoft Excel is prone to multiple remote code execution vulnerabilities due to insufficiant handeling of malformed Excel Files.
MS07-036 addresses the following issues.
- Excel does not perform sufficient validation when denoting the start of a Workspace designation.
- Excel does not perform sufficient data validation in processing the number of active worksheets, which can result in memory corruption.
- Excel does not correctly validate version information, which can result in memory corruption. - Consequence
- An attacker who successfully exploits this vulnerability could run arbitrary code on the affected system as the logged on user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Office 2000 Service Pack 3 (Microsoft Excel 2000 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=83D94D8E-DDA6-4D74-B40D-476C2F0A3AF4Microsoft Office XP Service Pack 3 (Microsoft Excel 2002 Service Pack 3):
http://www.microsoft.com/downloads/details.aspx?FamilyId=5E09D13B-D4B0-48FD-9880-73C180570267Microsoft Office 2003 Service Pack 2 (Microsoft Excel 2003 Service Pack 2):
http://www.microsoft.com/downloads/details.aspx?FamilyId=9D93C0CE-5124-4234-BA84-3C27005E010FMicrosoft Office 2003 Service Pack 2 (Microsoft Excel 2003 Viewer):
http://www.microsoft.com/downloads/details.aspx?FamilyId=11F42977-8828-494A-A183-D1ABA827B708Microsoft Office 2004 for Mac (Microsoft Office 2004 for Mac):
http://www.microsoft.com/mac/downloads.aspx?pid=download&location=/mac/download/Office2004/Office2004_1136.xml&secid=4&ssid=35&flgnosysreq=True2007 Microsoft Office System (Microsoft Office Excel 2007):
http://www.microsoft.com/downloads/details.aspx?FamilyId=9AB28283-0320-4527-B033-5E80EF32CD34Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
http://www.microsoft.com/downloads/details.aspx?FamilyId=E592AE5B-09AC-4F5B-B457-A54C9850AD4ARefer to Micrsoft Security Bulletin MS07-036 for further details.
-
Microsoft Office Publisher 2007 Could Allow Remote Code Execution (MS07-037)
- Severity
- Critical 4
- Qualys ID
- 110056
- Vendor Reference
- MS07-037
- CVE Reference
- CVE-2007-1754
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
Microsoft Office Publisher is a desktop publishing application.
A remote code execution vulnerability exists in the way Publisher does not adequately clear out memory resources when writing application data from disk to memory. An attacker could exploit the vulnerability by constructing a specially crafted Publisher (.pub) page.
Previously this was a Zero Day. - Consequence
- If the vulnerability is successfully exploited, this could result in the execution of arbitrary code in the context of the currently logged in user.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:2007 Microsoft Office System (Microsoft Office Publisher 2007):
http://www.microsoft.com/downloads/details.aspx?FamilyId=25D272E7-F2DD-4342-92BE-7EBC2E770B44Refer to Micrsoft Security Bulletin MS07-037 for further details.
-
Windows Vista Firewall Could Allow Information Disclosure (MS07-038)
- Severity
- Serious 3
- Qualys ID
- 90402
- Vendor Reference
- MS07-038
- CVE Reference
- CVE-2007-3038
- CVSS Scores
- Base 7.8 / Temporal 5.8
- Description
-
There is an information disclosure vulnerability in Windows Vista that could allow a remote anonymous attacker to send inbound network traffic to the affected system.
It would be possible for the attacker to gain information about the system over the network.
- Consequence
- An attacker who successfully exploits this vulnerability could bypass some of the firewall rules of an affected system.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows Vista:
http://www.microsoft.com/downloads/details.aspx?FamilyId=e9b64746-6afa-4a30-833d-e058e000c821Windows Vista x64 Edition:
http://www.microsoft.com/downloads/details.aspx?FamilyId=0df5d190-3ad7-42d5-8629-43c47ec450cbRefer to Microsoft Security Bulletin MS07-038 for further details.
-
Windows Active Directory Multiple Remote Code Execution Vulnerabilities (MS07-039)
- Severity
- Urgent 5
- Qualys ID
- 90403
- Vendor Reference
- MS07-039
- CVE Reference
- CVE-2007-0040, CVE-2007-3028
- CVSS Scores
- Base 10 / Temporal 7.4
- Description
-
Microsoft Security Advisory MS07-039 addresses the following issues with Active Directory on Windows 2003 and 2000 Server:
- A remote code execution vulnerability exists in the way that Active Directory validates a LDAP request.
- A denial of service vulnerability exists in the way that Microsoft Active Directory validates a client-sent LDAP request.
- Consequence
- An attacker who successfully exploited this vulnerability could take complete control of an affected system or cause the server to stop responding.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Microsoft Windows 2000 Server Service Pack 4:
http://www.microsoft.com/downloads/details.aspx?FamilyId=812e62c5-6e19-4b3b-8a10-861b871e1b41Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=28e84603-8159-4429-aaff-a1020531e84fWindows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=107902f9-be94-457f-a936-519efbd64779Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems:
http://www.microsoft.com/downloads/details.aspx?FamilyId=e5e5b425-fe7d-49d5-973f-f3fd7a1e04ebRefer to Micrsoft Security Bulletin MS07-039 for further details.
-
Microsoft .NET Framework Remote Code Execution Vulnerabilities (MS07-040)
- Severity
- Critical 4
- Qualys ID
- 90401
- Vendor Reference
- MS07-040
- CVE Reference
- CVE-2006-7192, CVE-2007-0041, CVE-2007-0042, CVE-2007-0043
- CVSS Scores
- Base 9.3 / Temporal 7.7
- Description
-
This update addresses two vulnerabilities affecting the client systems with .NET Framework installed and one vulnerability affecting web servers running ASP.NET.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
July 2007 Supplemental Updates (for Desktop Installer Tool) are available (KB931212)
Note: If no authentication credentials were supplied during the scan, and this vulnerability is reported as a potential threat; please re-run the scan using authentication credentials to confirm if the vulnerability exists on the target.
To manually verify the patch has been applied without running an authenticated scan, refer to the "Security Update Deployment" section of the MS07-04 Bulletin. The bulletin contains updated file version and registry key information. - Consequence
- The successful exploitation of these vulnerabilities could lead to remote code execution and information disclosure.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows 2000 Service Pack 4 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows XP Tablet PC Edition 2005 and Windows XP Media Center Edition 2005 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=829A2C5B-11EC-4ED7-91AB-6961034147BCWindows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows Vista and Windows Vista Service Pack 1 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows Server 2008 (Microsoft .NET Framework 1.0 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603Windows 2000 Service Pack 4 (Microsoft .NET Framework 1.1 ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=281FB2CD-C715-4F05-A01F-0455D2D9EBFBFor a complete list of patch download links, please refer to Microsoft Security Bulletin MS07-040.
-
Microsoft Internet Information Services Could Allow Remote Code Execution (MS07-041)
- Severity
- Serious 3
- Qualys ID
- 90400
- Vendor Reference
- MS07-041
- CVE Reference
- CVE-2005-4360
- CVSS Scores
- Base 7.8 / Temporal 6.1
- Description
-
This vulnerability exists in IIS Version 5.1 on Windows XP Professional Service Pack 2. An attacker can cause remote code execution by sending specially crafted URL to a
Web page hosted by IIS 5.1.
Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):
August 2007 Monthly Security Updates are Now Available on the ECE (KB939373)
July 2007 Supplemental Updates (for Desktop Installer Tool) are available (KB939373)
- Consequence
- An attacker who exploits this vulnerability can take complete control of the system. This update involves all supported 32 bit versions of XP Professional Service Pack 2.
- Solution
-
Patch:
Following are links for downloading patches to fix the vulnerabilities:Windows XP Professional Service Pack 2 (Microsoft Internet Information Services ):
http://www.microsoft.com/downloads/details.aspx?FamilyId=fccbfe90-f838-47df-8310-352e2fb47132Refer to Micrsoft Security Bulletin MS07-041 for further details.
These new vulnerability checks are included in Qualys vulnerability signature 1.17.96-4. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110062
- 110056
- 90402
- 90403
- 90401
- 90400
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.