Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 23 vulnerabilities that were fixed in 13 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 13 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft OpenType Compact Font Format (CFF) Driver Remote Code Execution Vulnerability (MS11-007)

  Severity

  Urgent 5

  Qualys ID

  90685

  Vendor Reference

  MS11-007

  CVE Reference

  CVE-2011-0033

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  OpenType is a font format developed jointly by Microsoft and Adobe as an extension of Apple's TrueType font format. An OpenType CFF font is an OpenType font that contains PostScript Type 1 outlines. OpenType fonts can contain either PostScript Type 1 or TrueType outlines.

  A remote code execution vulnerability exists in the way that the Windows OpenType Compact Font Format (CFF) driver improperly parses specially crafted OpenType fonts. (CVE-2011-0033)

  Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Windows OpenType Compact Font Format (CFF) driver validates the parameter values of specially crafted OpenType fonts.

  This security update is rated Critical for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2485376)
  

  Consequence

  An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS11-007 for further details.

  Workarounds:
  1) Disable the Preview Pane and Details Pane in Windows Explorer.

  Impact of workaround #1: Windows Explorer will not automatically display OTF fonts.

  2) Disable the WebClient service.

  Impact of workaround #2: When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the WebClient service will not start, and an error message will be logged in the System log.

• Microsoft Internet Explorer Remote Code Execution Vulnerability (MS11-003 and KB2488013)

  Severity

  Critical 4

  Qualys ID

  100096

  Vendor Reference

  KB2488013, MS11-003

  CVE Reference

  CVE-2010-3971, CVE-2011-0035, CVE-2011-0036, CVE-2011-0038

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft Internet Explorer is a Web browser available for Microsoft Windows.

  Microsoft Internet Explorer is exposed to a use-after-free vulnerability. The vulnerability is triggered when the applications tries to parse a specifically crafted "css" file. (CVE-2010-3971)

  A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. (CVE-2011-0035,CVE-2011-0036)

  A remote code execution vulnerability exists in the way that Internet Explorer handles the loading of DLL files. (CVE-2011-0038)

  Affected Versions:
  Internet Explorer 6, 7 and 8 are affected.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2482017)
  

  Consequence

  Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code or cause denial of service.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Internet Explorer 6)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

  Windows XP Service Pack 3 (Internet Explorer 7)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Internet Explorer 7)

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Internet Explorer 7)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS11-003.

  Workarounds:
  1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting

  2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

  Impact of workaround #1 and #2:
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

  3) Prevent the recursive loading of Cascading Style Sheets (CSS) in Internet Explorer

• Microsoft Internet Information Services (IIS) FTP Service Remote Code Execution Vulnerability (MS11-004)

  Severity

  Critical 4

  Qualys ID

  90673

  Vendor Reference

  MS11-004

  CVE Reference

  CVE-2010-3972

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  Microsoft Internet Information Service is a Web server available for Microsoft Windows.

  A remote code execution vulnerability exists in the FTP Service in Microsoft Internet Information Services 7.0 and Microsoft Internet Information Services 7.5. An attacker could exploit this vulnerability by sending a specially crafted FTP command to the FTP server.

  Microsoft has released a security update that resolves this vulnerability by modifying the way the IIS FTP Service handles specially crafted FTP commands.

  This security update is rated Important for Microsoft FTP Service 7.0 for IIS 7.0 and Microsoft FTP Service 7.5 for IIS 7.0 when installed on all supported editions of Windows Vista and Windows Server 2008, and for Microsoft FTP Service 7.5 for Internet Information Services 7.5 on all supported editions of Windows 7 and Windows Server 2008 R2.

  Consequence

  An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts in the context of the local system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft FTP Service 7.0 for IIS 7.0)

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft FTP Service 7.5 for IIS 7.0)

  Windows 7 for 32-bit Systems (Microsoft FTP Service 7.5 for IIS 7.5)

  Windows 7 for x64-based Systems (Microsoft FTP Service 7.5 for IIS 7.5)

  Windows Server 2008 R2 for x64-based Systems (Microsoft FTP Service 7.5 for IIS 7.5)

  Windows Server 2008 R2 for Itanium-based Systems (Microsoft FTP Service 7.5 for IIS 7.5)

  Refer to Microsoft Security Bulletin MS11-004 for further details.

  Workaround:
  1) Stop and disable the FTP Service

  Impact of workaround #1: Impact of workaround. Clients will not be able to connect to the FTP server and upload or download files using the FTP Service.

  2) Block FTP inbound traffic at the edge firewall

  Impact of workaround #2: Applications and services may use the affected port. Blocking connectivity to the port may cause various applications or services to not function.

• Microsoft Windows Active Directory Denial of Service Vulnerability (MS11-005)

  Severity

  Serious 3

  Qualys ID

  90683

  Vendor Reference

  MS11-005

  CVE Reference

  CVE-2011-0040

  CVSS Scores

  Base 5 / Temporal 3.9

  Description

  Active Directory provides central authentication and authorization services for Windows-based computers. Active Directory Lightweight Directory Services is an independent mode of Active Directory that provides dedicated directory services for applications.

  A denial of service vulnerability exists in implementations of Microsoft Windows Active Directory due to improper validation of service principal names (SPN), which could result in SPN collisions. When this occurs, services that use the SPN will downgrade to NT LAN Manager if configured to negotiate. Services that are not configured to negotiate will become unavailable, resulting in a denial of service. (CVE-2011-0040)

  Microsoft has released a security update that addresses the vulnerability by correcting the way the Active Directory server handles SPN update requests.

  This security update is rated Important for Active Directory on all supported editions of Windows Server 2003.

  Consequence

  Successfully exploiting this vulnerability might allow a remote attacker to cause denial of service.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Server 2003 Service Pack 2 (Active Directory)

  Windows Server 2003 x64 Edition Service Pack 2 (Active Directory)

  Windows Server 2003 with SP2 for Itanium-based Systems (Active Directory)

  Refer to Microsoft Security Bulletin MS11-005 for further details.

• Microsoft Windows Picture and Fax Viewer Library "shimgvw.dll" Integer Overflow Vulnerability (MS11-006)

  Severity

  Critical 4

  Qualys ID

  90678

  Vendor Reference

  MS11-006

  CVE Reference

  CVE-2010-3970

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  The Windows Picture and Fax Viewer "shimgvw.dll" library is used by Windows Explorer to generate thumbnail previews for media files.

  An integer overflow vulnerability exists in the "shimgvw" library. During the processing of an image within the "ConvertDIBSECTIONToThumbnail" function, a bitmap containing a large "biWidth" value can be used to cause an integer calculation overflow. This condition can lead to the overflow of a heap buffer and may result in the execution of arbitrary code on the targeted host.

  Affected Versions:
  Microsoft Windows XP SP3. Previous versions may also be affected.

  Previously, this was an iDefense exclusive vulnerability with iDefense ID: 631544

  Microsoft released security update MS11-006 to patch this issue.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2483185)
  

  Consequence

  Successfully exploiting this vulnerability might allow a remote attacker to execute arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS11-006 for further details.

  Workaround:
  1) Modify the Access Control List (ACL) on shimgvw.dll on Windows XP and Windows Server 2003 systems. Refer to Microsoft Knowledge Base Article 2483185 to use the automated Microsoft Fix it solution to enable or disable this workaround.

  Impact of workaround #1: Media files typically handled by the Windows Shell graphics processor will not be displayed properly.

  2) Disable viewing of thumbnails in Windows Explorer on Windows Vista and Windows Server 2008 systems.

  Impact of workaround #2: Windows Explorer will not display thumbnail images.

• Microsoft Windows Shell Graphics Processing Remote Code Execution Vulnerability (MS11-006 and KB2490606)

  Severity

  Serious 3

  Qualys ID

  118888

  Vendor Reference

  KB2490606, MS11-006

  CVE Reference

  CVE-2010-3970, CVE-2010-3971, CVE-2011-0347

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  The Windows user interface provides users with access to a wide variety of objects necessary for running applications and managing the operating system.

  Windows Shell Graphics is prone to a vulnerability that could allow remote code execution if a user views a specially crafted thumbnail image.

  Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Windows Shell graphics processor parses thumbnail images.

  This security update is rated Critical for all supported editions of Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2483185)
  

  Consequence

  An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the logged on user. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be impacted less than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS11-006 for further details.

  Workaround:
  1) Modify the Access Control List (ACL) on shimgvw.dll on Windows XP and Windows Server 2003 systems. Refer to Microsoft Knowledge Base Article 2483185 to use the automated Microsoft Fix it solution to enable or disable this workaround.

  Impact of workaround #1: Media files typically handled by the Windows Shell graphics processor will not be displayed properly.

  2) Disable viewing of thumbnails in Windows Explorer on Windows Vista and Windows Server 2008 systems.

  Impact of workaround #2: Windows Explorer will not display thumbnail images.

• Microsoft Office Visio Remote Code Execution Vulnerability (MS11-008)

  Severity

  Critical 4

  Qualys ID

  110142

  Vendor Reference

  MS11-008

  CVE Reference

  CVE-2011-0092, CVE-2011-0093

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft Visio is diagramming software for Microsoft Windows. It uses vector graphics to create diverse diagrams.

  Microsoft Office Visio is prone to the following vulnerabilities that result in remote code execution:

  A remote code execution vulnerability exists due to the application not properly validating objects in memory when parsing crafted Visio files. (CVE-2011-0092)

  A remote code execution vulnerability exists due to the application not properly handling corrupted structures when opening crafted Visio files. (CVE-2011-0093)

  Microsoft has released a security update that addresses the vulnerabilities by correcting the way that Microsoft Visio handles corrupted structures and objects in memory when parsing specially crafted Visio files.

  The security update is rated Important for all supported editions of Microsoft Visio 2002, Visio 2003 and Visio 2007.

  Consequence

  An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Visio 2002 Service Pack 2

  Microsoft Visio 2003 Service Pack 3

  Microsoft Visio 2007 Service Pack 2

  Refer to Microsoft Security Bulletin MS11-008 for further details.

  Workarounds:
  1) Restrict Access to ORMELEMS.DLL.

  Impact of workaround #1: Users will not be able to use the Database Modeling feature in Visio.

  2) Disable Add-ins in Microsoft Visio 2007.

  Impact of workaround #2: Functionality that relies on Visio add-ins will not work.

  3) Do not open Office files from untrusted sources.

• Microsoft JScript and VBScript Scripting Engines Information Disclosure Vulnerability (MS11-009)

  Severity

  Critical 4

  Qualys ID

  90681

  Vendor Reference

  MS11-009

  CVE Reference

  CVE-2011-0031

  CVSS Scores

  Base 4.3 / Temporal 3.4

  Description

  JScript and VBScript are interpreted, object-based scripting languages.

  An information disclosure vulnerability exists due to the way that the JScript and VBScript scripting engines process scripts in Web pages. When the scripting engine attempts to load the decoded script into memory in order to run it, memory corruption can occur.

  Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the JScript and VBScript scripting engines process scripts in Web pages.

  This security update is rated Important for all supported editions of Windows 7 and Moderate for all supported editions of Windows Server 2008 R2.

  Consequence

  The vulnerability could allow information disclosure if a user visited a specially crafted Web site.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows 7 for 32-bit Systems (JScript 5.8)

  Windows 7 for 32-bit Systems (VBScript 5.8)

  Windows 7 for x64-based Systems (JScript 5.8)

  Windows 7 for x64-based Systems (VBScript 5.8)

  Windows Server 2008 R2 for x64-based Systems (JScript 5.8)

  Windows Server 2008 R2 for x64-based Systems (VBScript 5.8)

  Windows Server 2008 R2 for Itanium-based Systems (JScript 5.8)

  Windows Server 2008 R2 for Itanium-based Systems (VBScript 5.8)

  Refer to Microsoft Security Bulletin MS11-009 for further details.

  Workaround:
  1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting

  2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

  Impact of workaround #1 and #2:
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

• Microsoft Windows Client/Server Run-time Subsystem Elevation of Privilege Vulnerability (MS11-010)

  Severity

  Critical 4

  Qualys ID

  118955

  Vendor Reference

  MS11-010

  CVE Reference

  CVE-2011-0030

  CVSS Scores

  Base 4.7 / Temporal 3.5

  Description

  Microsoft has released a security update to resolve a vulnerability in Microsoft Windows Client/Server Run-time Subsystem in Microsoft Windows Windows XP and Windows Server 2003.

  An elevation of privilege vulnerability exists because the Windows Client/Server Run-time Subsystem does not properly terminate user processes when a user logs out.

  The security update is rated Important for all supported editions of Microsoft Windows XP and Windows Server 2003.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2476687)
  

  Consequence

  An attacker must have valid login credentials and be able to log on locally to exploit this vulnerability. This vulnerability can not be exploited by anonymous users. The vulnerability could allow elevation of privilege if an attacker logs on to the system and starts a specially crafted application designed to continue running after the attacker logs out.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS11-010 for further details.

• Microsoft Windows Kernel Elevation of Privilege Vulnerabilities (MS11-011)

  Severity

  Critical 4

  Qualys ID

  90659

  Vendor Reference

  MS11-011

  CVE Reference

  CVE-2010-4398, CVE-2011-0045

  CVSS Scores

  Base 7.2 / Temporal 6

  Description

  Microsoft Windows is prone to a local privilege escalation vulnerability.

  This issue affects the 'RtlQueryRegistryValues()' API function. Specifically, the size of the output value may be returned as either UNICODE_STRING or ULONG size, while the actual returned buffer size is determined by registry key type. Local attackers may trigger a stack-based buffer overflow to bypass User Access Control (UAC) protection mechanisms.

  An elevation of privilege vulnerability exists due to the way that the Windows kernel allocates memory when reading user-supplied data. (CVE-2011-0045)

  Microsoft has released a security update that addresses the vulnerabilities by ensuring that the Windows kernel properly validates user-supplied data before allocating memory.

  This security update is rated Important for all supported versions of Microsoft Windows.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2393802)
  

  Consequence

  Successfully exploiting this vulnerability might allow an attacker to gain escalated privileges, create back doors or cause denial of service.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS11-011 for further details.

• Microsoft Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (MS11-012)

  Severity

  Critical 4

  Qualys ID

  90682

  Vendor Reference

  MS11-012

  CVE Reference

  CVE-2011-0086, CVE-2011-0087, CVE-2011-0088, CVE-2011-0089, CVE-2011-0090

  CVSS Scores

  Base 7.2 / Temporal 5.6

  Description

  The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.

  The kernel is prone to the multiple vulnerabilities could allow elevation of privilege if an attacker logged on locally and ran a specially crafted application.

  Microsoft has released a security update that addresses the vulnerabilities by correcting the way the Windows kernel-mode drivers validate input passed from user mode.

  This security update is rated Important for all supported versions of Microsoft Windows.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2479628)
  

  Consequence

  An attacker must have valid login credentials and be able to log on locally to exploit these vulnerabilities.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS11-012 for further details.

• Microsoft Windows Kerberos Elevation of Privilege Vulnerability (MS11-013)

  Severity

  Critical 4

  Qualys ID

  90686

  Vendor Reference

  MS11-013

  CVE Reference

  CVE-2011-0043, CVE-2011-0091

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  Kerberos is a protocol used to mutually authenticate users and services on an open and unsecured network.

  Kerberos is prone to an elevation of privilege vulnerability, that occurs when the Microsoft Kerberos implementation in Microsoft Windows supports weak hashing mechanisms such as CRC32. (CVE-2011-0043)

  Kerberos is prone to a spoofing vulnerability, that occurs when Windows does not correctly enforce the stronger default encryption standards included in Windows 7 and Windows Server 2008 R2, making it possible for a man-in-the-middle attacker to force a downgrade in Kerberos communication between a client and server to a weaker encryption standard than negotiated originally. (CVE-2011-0091)

  Microsoft has released an update that addresses the vulnerabilities by preventing the use of weak hashing algorithms in both Windows Kerberos and Windows KDC and by preventing the client from downgrading the encryption standard to DES for Kerberos communication between client and server.

  This security update is rated Important for all supported editions of Windows XP, Windows Server 2003, Windows 7 and Windows Server 2008 R2.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2496930)
  

  Consequence

  An attacker that successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with these elevated permissions.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS11-013 for further details.

• Microsoft Windows Local Security Authority Subsystem Service Local Elevation of Privilege Vulnerability (MS11-014)

  Severity

  Critical 4

  Qualys ID

  90684

  Vendor Reference

  MS11-014

  CVE Reference

  CVE-2011-0039

  CVSS Scores

  Base 7.2 / Temporal 5.3

  Description

  The Local Security Authority Subsystem Service (LSASS) provides an interface for managing local security, domain authentication, and Active Directory service processes.

  An elevation of privilege vulnerability is caused when the Windows LSASS processes a specially crafted authentication request.

  Microsoft has released a security update that addresses the vulnerability by correcting the manner in which LSASS handles specific values used in the authentication process.

  The update is rated Important for for Windows XP and 2003.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  February 2011 Security Updates for XPe and Standard 2009 Runtimes Are Now Available on ECE (KB2478960)
  

  Consequence

  An attacker who successfully exploited this vulnerability could gain complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS11-014 for further details.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.