Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 38 vulnerabilities that were fixed in 10 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 10 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Multiple Remote Code Execution Vulnerabilities (MS13-037)

  Severity

  Urgent 5

  Qualys ID

  100147

  Vendor Reference

  MS13-037

  CVE Reference

  CVE-2013-0811, CVE-2013-1297, CVE-2013-1306, CVE-2013-1307, CVE-2013-1308, CVE-2013-1309, CVE-2013-1310, CVE-2013-1311, CVE-2013-1312, CVE-2013-1313, CVE-2013-2551, CVE-2013-2552, CVE-2013-2553, CVE-2013-2554, CVE-2013-2556, CVE-2013-3140

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.

  Microsoft Internet Explorer is prone to a remote code execution vulnerability that exists in the way that Internet Explorer authorizes script access to data and handles objects in memory. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.

  Microsoft Internet Explorer is affected by an information disclosure vulnerability that could allow an attacker to gain access and read the contents of JSON data files.

  An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.
  Microsoft has released a security update that addresses the vulnerability by modifying the way that Internet Explorer handles objects in memory.

  This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10 on Windows servers.

  Consequence

  An attacker who successfully exploited this vulnerability could execute arbitrary code on affected systems with the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operates with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Internet Explorer 6)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

  Windows XP Service Pack 3 (Internet Explorer 7)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 Service Pack 2 (Internet Explorer 7)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-037.

  Workaround:
  1. Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
  2. Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
  

• Microsoft Internet Explorer Remote Code Execution Vulnerability (MS13-038)

  Severity

  Urgent 5

  Qualys ID

  100146

  Vendor Reference

  KB2847140, MS13-038

  CVE Reference

  CVE-2013-1347

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Internet Explorer is a graphical web browser developed by Microsoft and included as part of the Microsoft Windows operating systems.

  Internet Explorer is exposed to a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.

  Affected Versions:
  Internet Explorer versions 8 and 9.

  Consequence

  Successful exploitation allows execution of arbitrary code.
  An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Internet Explorer 8)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 8)

  Windows Server 2003 Service Pack 2 (Internet Explorer 8)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 8)

  Windows Vista Service Pack 2 (Internet Explorer 8)

  Windows Vista x64 Edition Service Pack 2 (Internet Explorer 8)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 8)

  Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 8)

  Windows 7 for 32-bit Systems Service Pack 1 (Internet Explorer 8)

  Windows 7 for x64-based Systems Service Pack 1 (Internet Explorer 8)

  Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Internet Explorer 8)

  Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (Internet Explorer 8)

  Windows 7 for 32-bit Systems Service Pack 1 (Internet Explorer 9)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-038.

  Workaround:
  
  1. Apply the Microsoft Fix it solution, "CVE-2013-1347 MSHTML Shim Workaround", that prevents exploitation of this issue
  2. Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones
  3. Add sites that you trust to the Internet Explorer Trusted sites zone
  4. Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone
  5. Add sites that you trust to the Internet Explorer Trusted sites zone
  

• Microsoft Windows HTTP.sys Denial of Service Vulnerability (MS13-039)

  Severity

  Critical 4

  Qualys ID

  90884

  Vendor Reference

  MS13-039

  CVE Reference

  CVE-2013-1305

  CVSS Scores

  Base 7.8 / Temporal 5.8

  Description

  Windows is prone to a remote denial of service vulnerability affecting the HTTP protocol stack (HTTP.sys).

  The vulnerability is caused when the HTTP protocol stack (HTTP.sys) improperly handles a malicious HTTP header.

  Microsoft has released a security update that addresses the vulnerability by correcting the way that HTTP.sys handles certain HTTP headers.

  This security update is rated Important for supported editions of Windows 8 and Windows Server 2012.

  Consequence

  An attacker who successfully exploited this vulnerability can cause a system to stop responding.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows 8 for 32-bit Systems

  Windows 8 for 64-bit Systems

  Windows Server 2012

  Windows Server 2012

  Refer to Microsoft Security Bulletin MS13-039 for further details.

  Workaround:
  1) Block TCP ports 80 and 443 at the enterprise perimeter firewall

  Impact of workaround #1 - HTTP and HTTPS applications will not be accessible from the external network.

• Microsoft .Net Framework Spoofing and Authentication Bypass Vulnerabilities (MS13-040)

  Severity

  Critical 4

  Qualys ID

  90885

  Vendor Reference

  MS13-040

  CVE Reference

  CVE-2013-1336, CVE-2013-1337

  CVSS Scores

  Base 7.5 / Temporal 5.9

  Description

  The Microsoft .NET Framework is a software framework for computers running Microsoft Windows operating systems.

  A spoofing vulnerability exists when the Microsoft .NET Framework fails to properly validate the signature of a specially crafted XML file (CVE-2013-1336).

  A security feature bypass vulnerability exists in the way that the Microsoft .NET Framework improperly creates policy requirements for authentication when setting up custom WCF endpoint authentication (CVE-2013-1337).

  This security update is rated Important for Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4, and Microsoft .NET Framework 4.5 on affected editions of Microsoft Windows

  Consequence

  Successfully exploiting these vulnerabilities might allow a remote attacker to modify the contents of an XML file without invalidating the signature associated with the file or steal information and take any actions in the context of an authenticated user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows XP Service Pack 3 (Microsoft .NET Framework 4)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 4)

  Windows Vista Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Vista Service Pack 2 (Microsoft .NET Framework 4)

  Windows Vista Service Pack 2 (Microsoft .NET Framework 4.5)

  Windows Vista x64 Edition Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  Windows Vista x64 Edition Service Pack 2 (Microsoft .NET Framework 4)

  Windows Vista x64 Edition Service Pack 2 (Microsoft .NET Framework 4.5)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft .NET Framework 2.0 Service Pack 2)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS13-040.

• Microsoft Lync Remote Code Execution Vulnerability (MS13-041)

  Severity

  Critical 4

  Qualys ID

  90886

  Vendor Reference

  MS13-041

  CVE Reference

  CVE-2013-1302

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  A remote code execution vulnerability exists when the Lync control attempts to access an object in memory that has been deleted. (CVE-2013-1302)

  Affected Software:
  Microsoft Communicator 2007 R2
  Microsoft Lync 2010
  Microsoft Lync 2010 Attendee
  Microsoft Lync Server 2013

  Consequence

  An attacker could exploit the vulnerability by convincing a target user to accept an invitation to launch specially crafted content within a Lync or Communicator session. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Communicator 2007 R2

  Microsoft Lync 2010 (32-bit)

  Microsoft Lync 2010 (64-bit)

  Microsoft Lync 2010 Attendee

  Microsoft Lync 2010 Attendee

  Microsoft Lync Server 2013

  Refer to Microsoft Security Bulletin MS13-041 for further details.

• Multiple Microsoft Publisher Remote Code Execution Vulnerabilities (MS13-042)

  Severity

  Critical 4

  Qualys ID

  110210

  Vendor Reference

  MS13-042

  CVE Reference

  CVE-2013-1316, CVE-2013-1317, CVE-2013-1318, CVE-2013-1319, CVE-2013-1320, CVE-2013-1321, CVE-2013-1322, CVE-2013-1323, CVE-2013-1327, CVE-2013-1328, CVE-2013-1329

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  Microsoft Office Publisher is a desktop publishing application.

  Multiple remote code execution vulnerabilities exists in the way that Microsoft Publisher parses Publisher files. These vulnerabilities could allow remote code execution if a user opens a specially crafted Publisher file with an affected version of Microsoft Publisher.
  This update resolves the following vulnerabilities:
  

  • Publisher Negative Value Allocation Vulnerability - CVE-2013-1316
  • Publisher Integer Overflow Vulnerability - CVE-2013-1317
  • Publisher Corrupt Interface Pointer Vulnerability - CVE-2013-1318
  • Publisher Return Value Handling Vulnerability - CVE-2013-1319
  • Publisher Buffer Overflow Vulnerability - CVE-2013-1320
  • Publisher Return Value Validation Vulnerability - CVE-2013-1321
  • Publisher Invalid Range Check Vulnerability - CVE-2013-1322
  • Publisher Incorrect NULL Value Handling Vulnerability - CVE-2013-1323
  • Publisher Signed Integer Vulnerability - CVE-2013-1327
  • Publisher Pointer Handling Vulnerability - CVE-2013-1328
  • Publisher Buffer Underflow Vulnerability - CVE-2013-1329

  Affected software:
  

  • Microsoft Office 2003 Service Pack 3
  • Microsoft Office 2007 Service Pack 3
  • Microsoft Office 2010 Service Pack 1

  Consequence

  Successful exploit could allow the remote, unauthenticated attacker to execute arbitrary code under the security context of the targeted user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2003 Service Pack 3 (Microsoft Publisher 2003 Service Pack 3)

  Microsoft Office 2007 Service Pack 3 (Microsoft Publisher 2007 Service Pack 3)

  Microsoft Office 2010 Service Pack 1 (32-bit editions) (Microsoft Publisher 2010 Service Pack 1 (32-bit editions) )

  Microsoft Office 2010 Service Pack 1 (64-bit editions) (Microsoft Publisher 2010 Service Pack 1 (64-bit editions))

  Refer to Microsoft Security Bulletin MS13-042 for further details.

• Microsoft Word Remote Code Execution Vulnerability (MS13-043)

  Severity

  Critical 4

  Qualys ID

  110211

  Vendor Reference

  MS13-043

  CVE Reference

  CVE-2013-1335

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  A remote code execution vulnerability exists in the Microsoft Word when shape data is incorrectly handled while parsing a specially crafted file. (CVE-2013-1335)

  Affected Software:
  Microsoft Office 2003 Service Pack 3
  Microsoft Word Viewer

  Consequence

  An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2003 Service Pack 3 (Microsoft Word 2003 Service Pack 3)

  Microsoft Word Viewer

  Refer to Microsoft Security Bulletin MS13-043 for further details.

• Microsoft Visio Information Disclosure Vulnerability (MS13-044)

  Severity

  Serious 3

  Qualys ID

  121175

  Vendor Reference

  MS13-044

  CVE Reference

  CVE-2013-1301

  CVSS Scores

  Base 4.3 / Temporal 3.2

  Description

  Microsoft Visio is diagramming software for Microsoft Windows. It uses vector graphics to create diverse diagrams.

  The security update addresses the vulnerability by correcting the manner in which the XML parser used by Visio resolves external entities within a specially crafted file.

  In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted Visio file to the user and by convincing the user to open the file.
  In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted Visio file.

  This security update is rated Important for all supported editions of Microsoft Visio 2003, Microsoft Visio 2007, and Microsoft Visio 2010.

  Consequence

  If this vulnerability is successfully exploited, attackers can read data from files on the target system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Visio 2003 Service Pack 3

  Microsoft Visio 2007 Service Pack 3

  Microsoft Visio 2010 Service Pack 1 (32-bit editions)

  Microsoft Visio 2010 Service Pack 1 (64-bit editions)

  Refer to Microsoft Security Bulletin MS13-044 for further details.

  Workaround:
  Do not open Office files that you receive from untrusted sources or that you receive unexpectedly from trusted sources

• Windows Essentials Information Disclosure Vulnerability (MS13-045)

  Severity

  Serious 3

  Qualys ID

  121173

  Vendor Reference

  MS13-045

  CVE Reference

  CVE-2013-0096

  CVSS Scores

  Base 6.8 / Temporal 5

  Description

  Windows Essentials is a suite of freeware applications by Microsoft.

  Windows Essentials is exposed security vulnerability which could allow information disclosure if a user opens Windows Writer using a specially crafted URL.

  The security update addresses the vulnerability by correcting the way Windows Writer handles URL parameters.

  This security update is rated Important for Windows Writer when installed on all supported editions of Microsoft Windows.

  Consequence

  If this vulnerability is successfully exploited, attackers can override Windows Writer proxy settings and overwrite files accessible to the user on the target system

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Essentials 2012

  Refer to Microsoft Security Bulletin MS13-045 for further details.

  Workaround:
  Apply the Microsoft Fix it solution, "Disable the Windows Writer" that prevents exploitation of this vulnerability See Microsoft Knowledge Base Article 2813707 to use the automated Microsoft Fix it solution to enable or disable this workaround.

• Microsoft Windows Kernel-Mode Driver Elevation of Privilege Vulnerabilities (MS13-046)

  Severity

  Critical 4

  Qualys ID

  90887

  Vendor Reference

  MS13-046

  CVE Reference

  CVE-2013-1332, CVE-2013-1333, CVE-2013-1334

  CVSS Scores

  Base 7.2 / Temporal 6

  Description

  The Windows kernel is the core of the operating system. The kernel provides system-level services such as device management and memory management, allocates processor time to processes and manages error handling.

  These vulnerabilities could allow elevation of privilege if a local attacker logs on to the system and runs a specially crafted application. The attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.

  This security update is rated Important for all supported editions of Windows XP, Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT.

  Consequence

  Successful exploitation of these vulnerabilities could allow a local attacker to execute arbitrary code with elevated privileges.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems Service Pack 1

  Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems Service Pack 1

  For a complete list of patch download links, please refer to Microsoft Security Bulletin ms13-046.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.