Cloud Platform
Platform
Solutions
Resources
Customers
Partners
Community
Support
Company
Login
Contact us
Try it
Asset Management
Vulnerability & Configuration Management
Risk Remediation
Threat Detection & Response
  • Overview

  • Platform Apps

  • Qualys Endpoint Security

    Advanced endpoint threat protection, improved threat context, and alert prioritization

  • Context XDR

    Extend detection and response beyond the endpoint to the enterprise

Compliance
Cloud Security
Cyber Risk Series | Cloud Security Edition | February 28 | Register Now

Microsoft security alert.

February 13, 2018

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 49 vulnerabilities that were fixed in 4 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 4 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

  • Microsoft Internet Explorer Security Update for February 2018

    Severity
    Urgent 5
    Qualys ID
    100329
    Vendor Reference
    KB4074588, KB4074590, KB4074591, KB4074592, KB4074593, KB4074594, KB4074596, KB4074598, KB4074736
    CVE Reference
    CVE-2018-0840, CVE-2018-0866
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Internet Explorer is a web-browser developed by Microsoft which is included in Microsoft Windows Operating Systems.

    Microsoft has released Cumulative Security Updates for Internet Explorer which addresses various vulnerabilities found in Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10) and Internet Explorer 11 (IE 11). The security updated is rated Moderate for for Internet Explorer 9 (IE 9) and Internet Explorer 10 (IE 10) and Critical for Internet Explorer 11 (IE 11).

    The Security Update addresses the vulnerabilities by fixing:

    1) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2018-0840)
    2) The update addresses the vulnerability by modifying how Internet Explorer handles objects in memory. (CVE-2018-0866)
    KB Articles associated with the Update:
    1) 4074598
    2) 4074736
    3) 4074591
    4) 4074594
    5) 4074590
    6) 4074596
    7) 4074592
    8) 4074588
    9) 4074593

    QID Detection Logic (Authenticated):
    Operating Systems: Windows XP Embedded, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for the file version of %windir%\System32\mshtml.dll
    The following KBs are checked:
    The patch version is 8.0.6001.24032(KB4074736)
    The patch version is 9.0.8112.21109 (KB4074736)
    The patch version is 10.0.9200.22314 (KB4074736 or KB4074593)
    The patch version is 11.0.9600.18921 (KB4074598 or KB4074736 or KB4074594)
    The patch version is 11.0.10240.17770 (KB4074596)
    The patch version is 11.0.10586.1417(KB4074591)
    The patch version is 11.0.14393.2068 (KB4074590)
    The patch version is 11.0.15063.909(KB4074592)
    The patch version is 11.0.16299.248 (KB4074588)

    Consequence
    Successful exploitation of the vulnerability will lead to remote code execution.

    Solution
    For more information, Customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Office and Microsoft Office Services and Web Apps Security Update February 2018

    Severity
    Critical 4
    Qualys ID
    110311
    Vendor Reference
    KB3114874, KB3172459, KB4011143, KB4011200, KB4011680, KB4011682, KB4011686, KB4011690, KB4011697, KB4011701, KB4011703, KB4011707, KB4011711, KB4011715
    CVE Reference
    CVE-2018-0841, CVE-2018-0850, CVE-2018-0851, CVE-2018-0852, CVE-2018-0853, CVE-2018-0864, CVE-2018-0869
    CVSS Scores
    Base 9.3 / Temporal 6.9
    Description
    Microsoft releases security updates on February 2018 to fix multiple security vulnerabilities:

    This security updates contain following KBs:
    KB3114874 KB3172459 KB4011143 KB4011200 KB4011680 KB4011682 KB4011686 KB4011690 KB4011697 KB4011701 KB4011703 KB4011707 KB4011711 KB4011715 QID Detection Logic:
    This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected office system.

    Consequence
    An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Office and Microsoft Office Services and Web Apps Security Update February 2018(Office)

  • Microsoft Edge Security Update for February 2018

    Severity
    Urgent 5
    Qualys ID
    91431
    Vendor Reference
    KB4074588, KB4074590, KB4074591, KB4074592, KB4074596
    CVE Reference
    CVE-2018-0763, CVE-2018-0771, CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0839, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861
    CVSS Scores
    Base 9.3 / Temporal 7.7
    Description
    Microsoft Edge is a web browser developed by Microsoft that replaces Internet Explorer as the default web browser.
    Microsoft Edge suffers multiple security vulnerabilities. The most severe of the vulnerabilities could allow remote code execution.

    KB Articles associated with the update:
    1) KB4074592
    2) KB4074588
    3) KB4074590
    4) KB4074591
    5) KB4074596

    QID Detection Logic (Authenticated):
    Operating Systems: All versions of Windows 10 and Windows Server 2016
    This QID checks for the file version of %windir%\System32\edgehtml.dll
    The following KBs are checked:
    The patch version is 11.0.10240.17770 (KB4074596)
    The patch version is 11.0.10586.1417(KB4074591)
    The patch version is 11.0.14393.2068 (KB4074590)
    The patch version is 11.0.15063.909(KB4074592)
    The patch version is 11.0.16299.248 (KB4074588)

    Consequence
    Successful exploitation of the vulnerability allows:

    1) Remote Code Execution
    2) Information Disclosure

    Solution
    For more information, customers are advised to refer the Security Update Guide.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    Microsoft Security Update Guide

  • Microsoft Windows Security Update February 2018

    Severity
    Critical 4
    Qualys ID
    91432
    Vendor Reference
    KB4034044, KB4058165, KB4073079, KB4073080, KB4074587, KB4074588, KB4074589, KB4074590, KB4074591, KB4074592, KB4074593, KB4074594, KB4074596, KB4074597, KB4074598, KB4074603, KB4074836, KB4074851
    CVE Reference
    CVE-2018-0742, CVE-2018-0755, CVE-2018-0756, CVE-2018-0757, CVE-2018-0760, CVE-2018-0761, CVE-2018-0809, CVE-2018-0810, CVE-2018-0820, CVE-2018-0821, CVE-2018-0822, CVE-2018-0823, CVE-2018-0825, CVE-2018-0826, CVE-2018-0827, CVE-2018-0828, CVE-2018-0829, CVE-2018-0830, CVE-2018-0831, CVE-2018-0832, CVE-2018-0833, CVE-2018-0842, CVE-2018-0843, CVE-2018-0844, CVE-2018-0846, CVE-2018-0847, CVE-2018-0855
    CVSS Scores
    Base 7.6 / Temporal 6.3
    Description
    Microsoft has released Cumulative Security Updates for Windows which addresses the following vulnerabilities:

    An information disclosure vulnerability exists in the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts.(CVE-2018-0755, CVE-2018-0760, CVE-2018-0761, CVE-2018-0855)
    An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory.(CVE-2018-0756, CVE-2018-0757, CVE-2018-0809, CVE-2018-0742, CVE-2018-0820, CVE-2018-0831)
    An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address.(CVE-2018-0810, CVE-2018-0830, CVE-2018-0829, CVE-2018-0843, CVE-2018-0842, CVE-2018-0832)
    An elevation of privilege vulnerability exists when Storage Services improperly handles objects in memory.(CVE-2018-0826)
    A remote code execution vulnerability exists in StructuredQuery when the software fails to properly handle objects in memory.(CVE-2018-0825)
    An elevation of privilege vulnerability exist when Named Pipe File System improperly handles objects.(CVE-2018-0823)
    An elevation of privilege vulnerability exists when NTFS improperly handles objects.(CVE-2018-0822)
    An elevation of privilege vulnerability exists when AppContainer improperly implements constrained impersonation.(CVE-2018-0821)
    A denial of service vulnerability exists in implementations of the Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client.(CVE-2018-0833)
    An elevation of privilege vulnerability exists when Storage Services or Common Log File System (CLFS)improperly handles objects in memory.(CVE-2018-0826, CVE-2018-0844, CVE-2018-0846)
    An elevation of privilege vulnerability exists in Microsoft Windows when the MultiPoint management account password is improperly secured.(CVE-2018-0828)
    A security feature bypass vulnerability exists in Windows Scripting Host which could allow an attacker to bypass Device Guard.(CVE-2018-0827)
    An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the users computer or data.(CVE-2018-0847)

    QID Detection Logic (Authenticated):
    Operating Systems: Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8.1, Windows RT 8.1, Windows10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
    This QID checks for following file versions %windir%\System32\Ntoskrnl.exe for all affected OS ecxcept Windows 10 and Windows 16:-
    The patch version of 6.0.6002.24282 (KB4073080)
    The patch version of 6.1.7601.24024 (KB4074587 or KB4074598)
    The patch version of 6.2.9200.22365 (KB4074589 or KB4074593)
    The patch version of 6.3.9600.18931 (KB4074597 or KB4074594)


    This QID checks for following file versions %windir%\System32\Win32kfull.sys.exe for Windows 10 and Windows 16:-
    The patch version of 10.0.10240.17770 (KB4074596)
    The patch version of 10.0.10586.1417 (KB4074591)
    The patch version of 10.0.14393.2068 (KB4074590)
    The patch version of 10.0.15063.909 (KB4074592)
    The patch version of 10.0.16299.248 (KB4074588)


    This QID checks for following files and its versions for Windows 2008 SP2:-
    The patch version of %windir%\System32\Win32k.sys 6.0.6002.24281 (KB4074603)
    The patch version of %windir%\System32\Msshsq.dll 7.0.6002.24282 (KB4074851)
    The patch version of %windir%\system32\clfs.sys 7.0.6002.24282 (KB4073079)
    The patch version of %windir%\System32\DriverStore\FileRepository\input.inf\Hidir.sys 6.0.6002.24282 (KB4074836)
    The patch version of %windir%\system32\drivers\tcpip.sys 7.0.6002.24296 (KB4058165)
    The patch version of %ProgramFiles%\Common Files\System\ado\msado15.dll (KB4034044)

    Consequence
    Successful exploitation allows an attacker to execute arbitrary code and take control of an affected system.
    Solution
    Customers are advised to refer to Microsoft Security Guidance for more details pertaining to this vulnerability.

    Patches:
    The following are links for downloading patches to fix these vulnerabilities:
    KB4034044
    KB4058165
    KB4073079
    KB4073080
    KB4074587
    KB4074588
    KB4074589
    KB4074590
    KB4074591
    KB4074592
    KB4074593
    KB4074594
    KB4074596
    KB4074597
    KB4074598
    KB4074603
    KB4074836
    KB4074851

These new vulnerability checks are included in Qualys vulnerability signature 2.4.265-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

  1. Ensure access to TCP ports 135 and 139 are available.
  2. Enable Windows Authentication (specify Authentication Records).
  3. Enable the following Qualys IDs:
    • 100329
    • 110311
    • 91431
    • 91432
  4. If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
  5. If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.