Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 20 vulnerabilities that were fixed in 13 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 13 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Active Directory Remote Code Execution Vulnerability (MS11-095)

  Severity

  Critical 4

  Qualys ID

  90762

  Vendor Reference

  MS11-095

  CVE Reference

  CVE-2011-3406

  CVSS Scores

  Base 9 / Temporal 6.7

  Description

  Active Directory Services contains an extensible and scalable set of services that enables you to efficiently manage corporate identities, credentials, information protection, and system and application settings.

  A remote code execution vulnerability exists in Active Directory. To exploit this vulnerability, an attacker would first need to acquire credentials to log on to an Active Directory domain. An attacker could then run a specially crafted application that could exploit the vulnerability and take complete control over the affected system.

  Affected Software:
  Active Directory, ADAM, and AD LDS when installed on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 (except Itanium), Windows 7, and Windows Server 2008 R2 (except Itanium).

  This security update is rated Important.

  Consequence

  Successfully exploiting this vulnerability might allow a remote authenticated user to execute arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Active Directory Application Mode (ADAM))

  Windows XP Professional x64 Edition Service Pack 2 (Active Directory Application Mode (ADAM))

  Windows Server 2003 Service Pack 2 (Active Directory)

  Windows Server 2003 Service Pack 2 (Active Directory Application Mode )

  Windows Server 2003 x64 Edition Service Pack 2 (Active Directory)

  Windows Server 2003 x64 Edition Service Pack 2 (Active Directory Application Mode )

  Windows Server 2003 with SP2 for Itanium-based Systems (Active Directory)

  Windows Vista Service Pack 2 (Active Directory Lightweight Directory Service (AD LDS))

  Windows Vista x64 Edition Service Pack 2 (Active Directory Lightweight Directory Service (AD LDS))

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Active Directory and Active Directory Lightweight Directory Service (AD LDS))

  Windows Server 2008 for x64-based Systems Service Pack 2 (Active Directory and Active Directory Lightweight Directory Service (AD LDS))

  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 (Active Directory Lightweight Directory Service (AD LDS))

  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 (Active Directory Lightweight Directory Service (AD LDS))

  Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Active Directory and Active Directory Lightweight Directory Service (AD LDS))

  Please refer to Microsoft Security Bulletin MS11-095 for further details.

• Microsoft Office IME (Chinese) Elevation of Privilege Vulnerability (MS11-088)

  Severity

  Critical 4

  Qualys ID

  110167

  Vendor Reference

  MS11-088

  CVE Reference

  CVE-2011-2010

  CVSS Scores

  Base 7.2 / Temporal 6.3

  Description

  Input Method Editors (IMEs) help solve an issue associated with entering information in certain languages via a keyboard.

  An elevation of privilege vulnerability exists due to the way that the Microsoft Office IME (Chinese) improperly exposes configuration options not designed to run on the secure desktop. (CVE-2011-2010)

  Affected Software:
  Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions)
  Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions)
  Microsoft Office Pinyin SimpleFast Style 2010 and Microsoft Office Pinyin New Experience Style 2010 (32-bit version)
  Microsoft Office Pinyin SimpleFast Style 2010 and Microsoft Office Pinyin New Experience Style 2010 (64-bit version)

  This security update is rated Important.

  Consequence

  An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

  Solution

  Patch:
  Following are links for downloading patches to fix this vulnerability:

  Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions) (Microsoft Pinyin IME 2010 (32-bit version))

  Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions) (Microsoft Pinyin IME 2010 (64-bit version))

  Refer to Microsoft Security Bulletin MS11-088 for further details.

• Microsoft Kernel-Mode Drivers Remote Code Execution Vulnerability (MS11-087 and KB2639658)

  Severity

  Urgent 5

  Qualys ID

  119717

  Vendor Reference

  2639658, MS11-087

  CVE Reference

  CVE-2011-3402

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Win32k.sys is a kernel-mode device driver and exists in the kernel of the Windows subsystem. It contains the window manager, which controls window displays; manages screen output; collects input from the keyboard, mouse, and other devices; and passes user messages to applications. It also contains the Graphics Device Interface (GDI), which is a library of functions for graphics output devices. Finally, it serves as a wrapper for DirectX support that is implemented in another driver (dxgkrnl.sys).

  Microsoft Windows kernel is prone to a remote code execution vulnerability when a Windows kernel-mode driver fails to properly handle the TrueType font type.

  This vulnerability is reported to be included in the Duqu Trojan and has been used in targeted attacks.

  Affected Software:
  Windows XP Service Pack 3
  Windows XP Professional x64 Edition Service Pack 2
  Windows Server 2003 Service Pack 2
  Windows Server 2003 x64 Edition Service Pack 2
  Windows Vista Service Pack 2
  Windows Vista x64 Edition Service Pack 2
  Windows Server 2008 for 32-bit Systems Service Pack 2
  Windows Server 2008 for x64-based Systems Service Pack 2
  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
  Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1
  

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2639417)
  

  Consequence

  If this vulnerability is successfully exploited, attackers can execute arbitrary code with kernel-level privileges. Failed exploit attempts may result in a denial of service.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  Refer to Microsoft Security Bulletin MS11-087 for further details.

  Workaround:
  1. Deny access to T2EMBED.DLL
  Note See Microsoft Knowledge Base Article 2639658 to use the automated Microsoft Fix it solution to enable or disable this workaround to deny access to t2embed.dll.

  Impact of Workaround -
  Applications that rely on embedded font technology will fail to display properly.

• Microsoft Office Remote Code Execution Vulnerability (MS11-089)

  Severity

  Critical 4

  Qualys ID

  110168

  Vendor Reference

  MS11-089

  CVE Reference

  CVE-2011-1983

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Word is a proprietary word processing application written and distributed by Microsoft.

  A remote code execution vulnerability exists in the way that Microsoft Word handles specially crafted Word files.

  Microsoft has released a security update that addresses the vulnerability by correcting the way that Microsoft Word parses specially crafted Word files.

  Affected Software:
  Microsoft Office 2007
  Microsoft Office 2010
  Microsoft Office for Mac 2011
  

  This security update is rated Important.

  Consequence

  The vulnerability could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploits this vulnerability could gain the same user rights as the logged-on user.

  Solution

  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2007 Service Pack 2 and Microsoft Office 2007 Service Pack 3

  Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions)

  Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions)

  Microsoft Office for Mac 2011

  Refer to Microsoft Security Bulletin MS11-089. Workaround:
  Do not open untrusted office files.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS11-089 Microsoft Office 2007 Service Pack 2 and Microsoft Office 2007 Service Pack 3
  MS11-089 Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (32-bit editions)
  MS11-089 Microsoft Office 2010 and Microsoft Office 2010 Service Pack 1 (64-bit editions)
  MS11-089 Microsoft Office for Mac 2011

• Microsoft Cumulative Security Update of ActiveX Kill Bits (MS11-090)

  Severity

  Urgent 5

  Qualys ID

  90761

  Vendor Reference

  MS11-090

  CVE Reference

  CVE-2011-3397

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  A remote code execution vulnerability exists in the Microsoft Time component. When the binary behavior is used in Internet Explorer, the behavior may corrupt the system state in such a way that an attacker could execute arbitrary code. (CVE-2011-3397)

  Affected Software:
  Windows XP Service Pack 3
  Windows XP Professional x64 Edition Service Pack 2
  Windows Server 2003 Service Pack 2
  Windows Server 2003 x64 Edition Service Pack 2
  Windows Server 2003 with SP2 for Itanium-based Systems
  Windows Vista Service Pack 2
  Windows Vista x64 Edition Service Pack 2
  Windows Server 2008 for 32-bit Systems Service Pack 2
  Windows Server 2008 for x64-based Systems Service Pack 2
  Windows Server 2008 for Itanium-based Systems Service Pack 2
  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1
  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1
  Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1
  Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  This security update is rated Critical.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2618451)
  

  Consequence

  An attacker who successfully exploits this vulnerability could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  Please refer to Microsoft Security Bulletin MS11-090 for further details.

• Microsoft Office Publisher Remote Code Execution Vulnerability (MS11-091)

  Severity

  Critical 4

  Qualys ID

  110161

  Vendor Reference

  MS11-091

  CVE Reference

  CVE-2011-1508, CVE-2011-3410, CVE-2011-3411, CVE-2011-3412

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Office Publisher is a desktop publishing application.

  Multiple vulnerabilities exists in the file parsing code when Microsoft Office Publisher opens a malicious file.
  
  This update resolves the following:
  Publisher Function Pointer Overwrite Vulnerability - CVE-2011-1508
  Publisher Out-of-bounds Array Index Vulnerablility - CVE-2011-3410
  Publisher Invalid Pointer Vulnerability - CVE-2011-3411
  Publisher Memory Corruption Vulnerability - CVE-2011-3412
  

  Affected Software:
  Microsoft Office Publisher 2003
  Microsoft Office Publisher 2007
  

  This security update is rated Important.
  Previously this was a Zero Day detection.

  Consequence

  An attacker can exploit this issue by persuading an unsuspecting user into opening a malicious file. This vulnerability allows attackers to execute arbitrary code on the user's system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2003 Service Pack 3 (Microsoft Publisher 2003 Service Pack 3)

  Microsoft Office 2007 Service Pack 2 (Microsoft Publisher 2007 Service Pack 2)

  Microsoft Office 2007 Service Pack 3 (Microsoft Publisher 2007 Service Pack 3)

  Refer to Microsoft Security Bulletin MS11-091 for further details.

• Microsoft Windows Media Player Remote Code Execution Vulnerability (MS11-092)

  Severity

  Urgent 5

  Qualys ID

  119547

  Vendor Reference

  MS11-092

  CVE Reference

  CVE-2011-3401

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Windows Media Player is a video and audio file player for Windows-based systems. It supports multiple file formats and allows playing files from either the local file system or the network.

  A vulnerability exists in the Windows Media Player XDS Codec filter during the processing of a specially crafted DVR-MS file. If a large length value is supplied within a certain chunk of a DVR-MS file, a heap allocation for the chunk data can fail and the return value of the allocation routine will not be checked for an error.

  Microsoft has released a security update that addresses the vulnerability by modifying the way that Windows Media Player and Windows Media Center open specially crafted .dvr-ms files.

  Affected Software:
  Windows XP (including Windows XP Media Center Edition 2005)
  Windows Vista
  Windows 7

  This security update is rated Critical.

  Note: Previously this was an iDefense vulnerability with ID: 647554

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2619339)
  

  Consequence

  If this vulnerability is successfully exploited, attackers can execute arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Media Center Edition 2005 Service Pack 3

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

  Refer to Microsoft Security Bulletin MS11-092.

  Workaround:
  

  It is possible to use Windows ACLs to block access to the vulnerable library. To prevent this library from loading, use the calcs program included with Windows:

  cacls "%windir%\system32\encdec.dll" /E /P everyone:N

  This will prevent Windows Media Player from loading this library. To undo this workaround, use the following command:

  cacls "%windir%\system32\encdec.dll" /E /Reveryone

• Microsoft Windows OLE Remote Code Execution Vulnerability (MS11-093)

  Severity

  Critical 4

  Qualys ID

  90759

  Vendor Reference

  MS11-093

  CVE Reference

  CVE-2011-3400

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  A vulnerability exists in OLE that could lead to remote code execution if a user opens a file that contains a specially crafted OLE object. This security update addresses the vulnerability by modifying the way that OLE objects are handled in memory.

  Affected Software:
  Windows XP
  Windows Server 2003
  

  This security update is rated Important.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2624667)
  

  Consequence

  This vulnerability could allow remote code execution if a user opens a file that contains a specially crafted OLE object. An attacker who successfully exploits this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix this vulnerability:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS11-093 for further details.

• Microsoft PowerPoint Remote Code Execution Vulnerability (MS11-094)

  Severity

  Critical 4

  Qualys ID

  110169

  Vendor Reference

  MS11-094

  CVE Reference

  CVE-2011-3396, CVE-2011-3413

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  A remote code execution vulnerability exists in the way that Microsoft PowerPoint handles the loading of DLL files and specially crafted PowerPoint files. The security update addresses the vulnerabilities by correcting the way that PowerPoint loads external libraries and modifying the way that it validates OfficeArt records when opening PowerPoint files.

  Affected Software:
  Microsoft PowerPoint 2007 Service Pack 2
  Microsoft PowerPoint 2010
  Microsoft Office 2008 for Mac
  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2 and Microsoft PowerPoint Viewer 2007 Service Pack 2.

  This security update is rated Important.

  Consequence

  An attacker who successfully exploits either of the vulnerabilities could take complete control of an affected system. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2007 Service Pack 2 (Microsoft PowerPoint 2007 Service Pack 2)

  Microsoft Office 2010 (32-bit editions) (Microsoft PowerPoint 2010 (32-bit editions))

  Microsoft Office 2010 (64-bit editions) (Microsoft PowerPoint 2010 (64-bit editions))

  Microsoft Office 2008 for Mac

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2

  Microsoft PowerPoint Viewer 2007 Service Pack 2

  Microsoft Office 2007 Service Pack 2 (Microsoft PowerPoint 2007 Service Pack 2)

  Microsoft Office 2010 (32-bit editions) (Microsoft PowerPoint 2010 (32-bit editions))

  Microsoft Office 2010 (64-bit editions) (Microsoft PowerPoint 2010 (64-bit editions))

  Microsoft Office 2008 for Mac

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2

  Microsoft PowerPoint Viewer 2007 Service Pack 2

  Refer to Microsoft Security Bulletin MS11-094 for further details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS11-094 Microsoft Office 2007 Service Pack 2(Microsoft PowerPoint 2007 Service Pack 2)
  MS11-094 Microsoft Office 2008 for Mac
  MS11-094 Microsoft Office 2010 (32-bit editions)(Microsoft PowerPoint 2010 (32-bit editions))
  MS11-094 Microsoft Office 2010 (64-bit editions)(Microsoft PowerPoint 2010 (64-bit editions))
  MS11-094 Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
  MS11-094 Microsoft PowerPoint Viewer 2007 Service Pack 2

• Microsoft Excel Remote Code Execution Vulnerabilities (MS11-096)

  Severity

  Critical 4

  Qualys ID

  110170

  Vendor Reference

  MS11-096

  CVE Reference

  CVE-2011-1986, CVE-2011-3403

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft for Windows and Mac OS X.

  Microsoft Excel is vulnerable to a remote code execution vulnerability due to incorrect handling of objects in memory.

  Affected Software:
  Microsoft Office Excel 2003
  Microsoft Office 2004 for Mac
  

  This security update is rated Important.
  

  Consequence

  An attacker can exploit this issue by persuading an unsuspecting user to open a malicious file. This vulnerability allows attackers to execute arbitrary code on the user's system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3)

  Microsoft Office 2004 for Mac

  Microsoft Office 2003 Service Pack 3 (Microsoft Excel 2003 Service Pack 3)

  Microsoft Office 2004 for Mac

  Refer to Microsoft Security Bulletin MS11-096 for further details.

• Microsoft Windows Client/Server Run-time Subsystem Elevation of Privilege Vulnerability (MS11-097)

  Severity

  Serious 3

  Qualys ID

  90760

  Vendor Reference

  MS11-097

  CVE Reference

  CVE-2011-3408

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  The Client/Server Run-time Subsystem (CSRSS) is the user-mode portion of the Win32 subsystem. CSRSS is an essential subsystem that must be running at all times. CSRSS is responsible for console windows, and creating and/or deleting threads.

  An elevation of privilege vulnerability exists in the Client/Server Run-time Subsystem (CSRSS), allowing arbitrary code to be executed in the context of another process.

  This security update is rated Important for all supported releases of Microsoft Windows.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2620712)
  

  Consequence

  Successfully exploiting this vulnerability might allow a locally authenticated attacker to gain escalated privileges.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1

  Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1

  Please refer to Microsoft Security Bulletin MS11-097 for further details.

• Microsoft Windows Kernel Privilege Escalation Vulnerability (MS11-098)

  Severity

  Critical 4

  Qualys ID

  90758

  Vendor Reference

  MS11-098

  CVE Reference

  CVE-2011-2018

  CVSS Scores

  Base 7.2 / Temporal 6

  Description

  An elevation of privilege vulnerability exists in the Windows kernel due to the way the kernel accesses an object that has not been correctly initialized. The security update addresses the vulnerability by helping to ensure that the Windows kernel initializes objects in memory.

  Affected Software:
  32-bit editions of Windows XP
  32-bit editions of Windows Server 2003
  32-bit editions of Windows Vista
  32-bit editions of Windows Server 2008
  32-bit editions of Windows 7

  This security update is rated Important.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2633171)
  

  Consequence

  The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application designed to exploit the vulnerability. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users.

  Solution

  Patch:
  Following are links for downloading patches to fix this vulnerability:

  Windows XP Service Pack 3

  Windows Server 2003 Service Pack 2

  Windows Vista Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

  Windows XP Service Pack 3

  Windows Server 2003 Service Pack 2

  Windows Vista Service Pack 2

  Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1

  Refer to Microsoft Security Bulletin MS11-098 for further details.

• Microsoft Cumulative Security Update for Internet Explorer (MS11-099)

  Severity

  Critical 4

  Qualys ID

  100114

  Vendor Reference

  MS11-099

  CVE Reference

  CVE-2011-1992, CVE-2011-2019, CVE-2011-3404

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft Internet Explorer is a Web browser for Microsoft Windows.

  Internet Explorer is prone to an information disclosure vulnerability because the Internet Explorer XSS Filter allows attackers to read content from different domains through trial and error attacks. (CVE-2011-1992)

  A remote code execution vulnerability exists in the way that Internet Explorer handles the loading of DLL files. Internet Explorer does not properly restrict the path used for loading external libraries. (CVE-2011-2019)

  Internet Explorer is prone to an information disclosure vulnerability because, during certain processes, Internet Explorer incorrectly renders Web pages. (CVE-2011-3404)

  Affected Software:
  Windows XP Service Pack 3 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
  Windows Server 2003 Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8)
  Windows Vista Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows Vista x64 Edition Service Pack 2(Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows 7 for 32-bit Systems and Windows 7 for 32-bit Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows 7 for x64-based Systems and Windows 7 for x64-based Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows Server 2008 R2 for x64-based Systems and Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)
  Windows Server 2008 R2 for Itanium-based Systems and Windows Server 2008 R2 for Itanium-based Systems Service Pack 1 (Internet Explorer 6,Internet Explorer 7,Internet Explorer 8,Internet Explorer 9)

  This security update is rated Important.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2011 Security Updates are Live on ECE for XPe and Standard 2009 (KB2618444)
  

  Consequence

  An attacker who successfully exploited this vulnerability could run arbitrary code as the logged on user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. Users whose accounts are configured to have fewer user rights on the system could be less exposed than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Internet Explorer 6)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

  Windows XP Service Pack 3 (Internet Explorer 7)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

  Windows Vista Service Pack 2 (Internet Explorer 7)

  Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for Itanium-based Systems Service Pack 2 (Internet Explorer 7)

  Please refer to Microsoft Security Bulletin MS11-099 for further details.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.