Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 35 vulnerabilities that were fixed in 15 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 15 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Windows Shell Remote Code Execution Vulnerability (MS10-046 and KB2286198)

  Severity

  Urgent 5

  Qualys ID

  90616

  Vendor Reference

  KB2286198, MS10-046

  CVE Reference

  CVE-2010-2568

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Windows is prone to a vulnerability that may allow a file to automatically run because the software fails to handle "LNK" files properly.

  The vulnerability exists because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut.

  The attacker must entice a victim into attaching a form of removable media, such as a USB drive or CD-ROM.

  Affected Software:
  Windows XP Service Pack 3
  Windows XP Professional x64 Edition Service Pack 1
  Windows XP Professional x64 Edition Service Pack 2
  Windows Server 2003 Service Pack 2
  Windows Server 2003 x64 Edition Service Pack 1
  Windows Server 2003 x64 Edition Service Pack 2
  Windows Server 2003 with SP2 for Itanium-based Systems
  Windows Vista Service Pack 1 and Windows Vista Service Pack 2
  Windows Vista x64 Edition
  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
  Windows 7 for 32-bit Systems
  Windows 7 for x64-based Systems
  Windows Server 2008 R2 for x64-based Systems
  Windows Server 2008 R2 for Itanium-based Systems

  Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.
  For details see: http://www.qualys.com/research/exploits/#KB2286198

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB2286198)
  

  Consequence

  Successfully exploiting this vulnerability might allow an attacker to execute arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS10-046 for further details on patches and workarounds.

  Workaround:
  1) Disable the displaying of icons for shortcuts

  Impact of workaround #1: Disabling icons from being displayed for shortcuts prevents the issue from being exploited on affected systems. When this workaround is implemented, shortcut files and Internet Explorer shortcuts will no longer have an icon displayed.

  2) Disabling the WebClient service helps protect affected systems from attempts to exploit this vulnerability by blocking the most likely remote attack vector through the Web Distributed Authoring and Versioning (WebDAV) client service.

  Impact of workaround #2: When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the Web Client service will not start, and an error message will be logged in the System log.

  3) Blocking the download of LNK and PIF files on the Internet Gateway provides protection against remote exploitation of these attacks.

• Microsoft Windows Kernel Elevation of Privilege Vulnerability (MS10-047)

  Severity

  Critical 4

  Qualys ID

  90619

  Vendor Reference

  MS10-047

  CVE Reference

  CVE-2010-1888, CVE-2010-1889, CVE-2010-1890

  CVSS Scores

  Base 7.2 / Temporal 6

  Description

  The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling. The kernel is prone to the following vulnerabilities:

  An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel deals with specific thread creation attempts. (CVE-2010-1888)

  An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel initializes objects while handling certain errors. (CVE-2010-1889)

  A denial of service vulnerability exists in the way that the Windows kernel validates access control lists on kernel objects. (CVE-2010-1890)

  Affected Operating Systems:
  Windows XP Service Pack 3
  Windows Vista Service Pack 1 and Windows Vista Service Pack 2
  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
  Windows 7 for 32-bit Systems
  Windows 7 for x64-based Systems
  Windows Server 2008 R2 for x64-based Systems

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB981852)
  

  Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory. For details see: http://www.qualys.com/research/exploits/#MS10-047

  Consequence

  An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode or cause system to become unresponsive and automatically restart . An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS10-047 for further details.

• Microsoft Windows Kernel-Mode Drivers Privilege Elevation Vulnerability (MS10-048)

  Severity

  Critical 4

  Qualys ID

  90627

  Vendor Reference

  MS10-048

  CVE Reference

  CVE-2010-1887, CVE-2010-1894, CVE-2010-1895, CVE-2010-1896, CVE-2010-1897

  CVSS Scores

  Base 7.2 / Temporal 5.6

  Description

  The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling. The kernel is prone to the following vulnerabilities:

  A denial of service vulnerability exists because the Windows kernel-mode drivers do not properly validate an argument passed to a system call.

  An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly handle certain exceptions.

  An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly allocate memory when copying data from user mode.

  An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly validate input passed from user mode.

  The Windows kernel-mode drivers do not properly validate pseudo handles within callback parameters when creating a new window allowing privilege escalation attacks to be conducted.

  Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which Windows kernel-mode drivers handle exceptions, allocate memory, and validate system call arguments, user-mode input, and new window callback parameters.

  Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.
  For details see: http://www.qualys.com/research/exploits/#MS10-048

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB2160329)
  

  Consequence

  Successful exploitation could allow an attacker to run code or to elevate the attacker's user rights. An attacker could also cause the affected system to stop responding and automatically restart.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS10-048 for further details.

• Microsoft Windows SChannel Remote Code Execution Vulnerability (MS10-049)

  Severity

  Serious 3

  Qualys ID

  90621

  Vendor Reference

  MS10-049

  CVE Reference

  CVE-2009-3555, CVE-2010-2566

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  The Secure Channel (SChannel) security package is a Security Support Provider (SSP) that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) Internet standard authentication protocols. It is prone to the following vulnerabilities:

  A spoofing vulnerability exists in the TLS/SSL protocol, implemented in the Microsoft Windows SChannel authentication component.

  A remote code execution vulnerability exists in the way that SChannel on a client machine validates a certificate request message sent by the server.

  Microsoft has released a security update that addresses the vulnerabilities by implementing RFC 5746 and additional validation on SSL responses returned by a server.

  This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003; and Important for all supported editions of Windows Vista, Windows Server2008, Windows 7, and Windows Server 2008 R2.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB980436)
  

  Consequence

  The more severe of these vulnerabilities could allow remote code execution if a user visits a specially crafted Web site that is designed to exploit these vulnerabilities through an Internet Web browser. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger message that takes them to the attacker's Web site.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS10-049 for further details.

  Workaround:
  - Enable SSLAlwaysNegoClientCert on IIS 6 and above.

  Impact of the workaround: Setting this flag will require the client to authenticate prior to loading any element from the SSL-protected web site. This will cause the browser to always prompt the user for a client certificate upon connecting to the SSL protected web site.

  Refer to the advisory to obtain detailed instructions on applying the workaround.

• Microsoft Windows Movie Maker Remote Code Execution Vulnerability (MS10-050)

  Severity

  Critical 4

  Qualys ID

  90623

  Vendor Reference

  MS10-050

  CVE Reference

  CVE-2010-2564

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Windows Movie Maker is an application that allows users to create, edit and add special effects to home movies.

  A remote code execution vulnerability exists in the way that Windows Movie Maker handles specially crafted project files. This vulnerability requires a malicious user to send a specially crafted Movie Maker file and convince the user to open the specially crafted file.

  Microsoft has released a security update that addresses the vulnerability by changing the way that Windows Movie Maker parses Movie Maker project files.

  This security update is rated Important for Windows Movie Maker 2.1, Windows Movie Maker 2.6, and Windows Movie Maker 6.0.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB981997)
  

  Consequence

  Successful exploitation could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Movie Maker 2.1)

  Windows XP Professional x64 Edition Service Pack 2 (Movie Maker 2.1)

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Movie Maker 6.0[1])

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Movie Maker 2.6[2])

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Movie Maker 6.0[1])

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Movie Maker 2.6[2])

  Refer to Microsoft Security Bulletin MS10-050 for further details.

  Workaround:
  - Remove the Movie Maker .MSWMM file association.

  Impact of the workaround: Double-clicking an MSWMM file will no longer launch Windows Movie Maker.

  Refer to the advisory to obtain detailed instructions on applying the workaround.

• Microsoft Windows XML Core Services Remote Code Execution Vulnerability (MS10-051)

  Severity

  Urgent 5

  Qualys ID

  90625

  Vendor Reference

  MS10-051

  CVE Reference

  CVE-2010-2561

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  A remote code execution vulnerability exists in the way that Microsoft XML Core Services handles HTTP responses.

  Microsoft has released a security update that addresses the vulnerability by ensuring that HTTP responses are handled correctly by MSXML.

  This security update is rated Critical for Microsoft XML Core Services 3.0 on all supported releases of Windows XP, Windows Vista, and Windows 7; and Moderate for Microsoft XML Core Services 3.0 on all supported releases of Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB2079403)
  

  Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory. For details see: http://www.qualys.com/research/exploits/#MS10-051

  Consequence

  The vulnerability could allow remote code execution if a user browses a Web site that contains specially crafted content or opens specially crafted HTML e-mail. An attacker who successfully exploits this vulnerability could take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Microsoft XML Core Services 3.0)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

  Windows Server 2003 Service Pack 2 (Microsoft XML Core Services 3.0)

  Windows Server 2003 x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

  Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft XML Core Services 3.0)

  Windows Vista Service Pack 1 (Microsoft XML Core Services 3.0)

  Windows Vista Service Pack 2 (Microsoft XML Core Services 3.0)

  Windows Vista x64 Edition Service Pack 1 (Microsoft XML Core Services 3.0)

  Windows Vista x64 Edition Service Pack 2 (Microsoft XML Core Services 3.0)

  Windows Server 2008 for 32-bit Systems (Microsoft XML Core Services 3.0)

  Windows Server 2008 for 32-bit Systems Service Pack 2 (Microsoft XML Core Services 3.0)

  Windows Server 2008 for x64-based Systems (Microsoft XML Core Services 3.0)

  Windows Server 2008 for x64-based Systems Service Pack 2 (Microsoft XML Core Services 3.0)

  Windows Server 2008 for Itanium-based Systems (Microsoft XML Core Services 3.0)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS10-051.

  Workarounds:
  1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting

  2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

  Impact of workaround #1 and #2:
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

  3) Restrict Web sites to only your trusted Web sites.

  Refer to the advisory to obtain additional details on applying the workarounds.

• Microsoft MPEG Layer-3 Codecs Remote Code Execution Vulnerability (MS10-052)

  Severity

  Critical 4

  Qualys ID

  90629

  Vendor Reference

  MS10-052

  CVE Reference

  CVE-2010-1882

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  The MPEG Layer-3 audio codec is delivered as part of Windows Media and as a part of the Windows operating system. A vulnerability exists in the Microsoft MPEG Layer-3 audio codecs when a user opens a specially crafted media file or receives a crafted streaming content.

  Microsoft has released a security update that addresses the vulnerability by correcting the way that the Microsoft MPEG Layer-3 audio codecs handle the MPEG Layer-3 audio stream in specially crafted media files.

  This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003 (except supported Itanium-based editions).

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB2115168)
  

  Consequence

  Successful exploitation of this vulnerability could allow remote code execution.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Refer to Microsoft Security Bulletin MS10-052 for further details.

  Workarounds:
  1) Unregister l3codecx.ax

  2) Deny access to l3codecx.ax

  3) Disable MPEG Layer-3 parsing in DirectShow

  Impact of workarounds: MPEG Layer-3 Parsing is disabled in applications that use DirectShow to play MPEG Layer-3 content.

  Refer to the advisory to obtain detailed instructions on applying the workarounds.

• Microsoft Internet Explorer Cumulative Security Update (MS10-053)

  Severity

  Critical 4

  Qualys ID

  100089

  Vendor Reference

  MS10-053

  CVE Reference

  CVE-2010-1258, CVE-2010-2556, CVE-2010-2557, CVE-2010-2558, CVE-2010-2559, CVE-2010-2560

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft Internet Explorer is a Web browser for Microsoft Windows.

  Internet Explorer is prone to the following vulnerabilities:

  An information disclosure vulnerability exists because Internet Explorer incorrectly interprets the origin of script, allowing the script to run in the context of a domain or Internet Explorer security zone other than where it originated. (CVE-2010-1258)

  Multiple remote code execution vulnerabilities exist in the way Internet Explorer attempts to access an object that has not been initialized or has been deleted. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2556,CVE-2010-2557)

  A remote code execution vulnerability exists in the way Internet Explorer attempts to access an object that may have been corrupted due to a race condition. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2558)

  A HTML layout memory corruption vulnerability exists in the way Internet Explorer attempts to access incorrectly initialized memory under certain conditions. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2560)

  Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Internet Explorer enforces security checks and handles objects in memory.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB2183461)
  

  Consequence

  Successful exploitation can allow a remote attacker to execute arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3 (Internet Explorer 6)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 6)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 6)

  Windows XP Service Pack 3 (Internet Explorer 7)

  Windows XP Professional x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2003 with SP2 for Itanium-based Systems (Internet Explorer 7)

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2 (Internet Explorer 7)

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2 (Internet Explorer 7)

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Internet Explorer 7)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS10-053.

  Workaround:
  1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.

  2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

  Impact of workaround #1 and #2:
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

  Refer to the advisory to obtain additional details on applying the workarounds.

• Microsoft Windows SMB Server Remote Code Execution Vulnerability (MS10-054)

  Severity

  Serious 3

  Qualys ID

  90626

  Vendor Reference

  MS10-054

  CVE Reference

  CVE-2010-2550, CVE-2010-2551, CVE-2010-2552

  CVSS Scores

  Base 10 / Temporal 8.7

  Description

  Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol used in Microsoft Windows. Microsoft Windows SMB Server is prone to the following vulnerabilities:

  An unauthenticated remote code execution vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB packets. (CVE-2010-2550)

  A denial of service vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB packets. (CVE-2010-2551)

  A denial of service vulnerability exists in the way that Microsoft Server Message Block (SMB) Protocol software handles specially crafted SMB compounded requests. (CVE-2010-2552)

  Microsoft has released a security update that addresses these vulnerabilities by correcting the way that SMB validates SMB requests.

  This security update is rated Critical for all supported editions of Windows XP and Important for all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB982214)
  

  Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory. For details see: http://www.qualys.com/research/exploits/#MS10-054

  Consequence

  An attempt to exploit the vulnerability would not require authentication, allowing an attacker to exploit the vulnerability by sending a specially crafted network message to a computer running the Server service.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS10-054 for further details.

  Workaround:
  1) TCP ports 139 and 445 should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability.

  Impact of workaround #1: Blocking the ports can cause several windows services or applications using those ports to stop functioning.

  Refer to the advisory to obtain additional details on applying the workarounds.

• Microsoft Windows Cinepak Codec Remote Code Execution Vulnerability (MS10-055)

  Severity

  Urgent 5

  Qualys ID

  90622

  Vendor Reference

  MS10-055

  CVE Reference

  CVE-2010-2553

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  The Cinepak codec is a media encoder and decoder supported by the Windows Media Player. This codec allows bitstream encoding and decoding for media files.

  Cinepack codec is prone to a vulnerability because it does not properly handle specially crafted media files.

  The vulnerability could allow remote code execution if a user opens a specially crafted media file or receives specially crafted streaming content from a Web site or any application that delivers Web content.

  Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Cinepak code decompresses media files.

  This security update is rated Critical for all supported editions of Windows XP, Windows Vista, and Windows 7.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB982665)
  

  Consequence

  Successfully exploiting this vulnerability could allow a remote attacker to gain the same user rights as the local user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Refer to Microsoft Security Bulletin MS10-055 for further details.

  Workarounds:
  1) Modify the Access Control List (ACL) on iccvid.dll.

  Impact of workaround #1: IMedia files encoded using the Cinepak codec will fail to play in multimedia.

  2) Disable the parsing of Cinepac encoded files in DirectShow.

  Impact of workaround #2: MPEG Layer-3 Parsing is disabled in applications that use DirectShow to play MPEG Layer-3 content.

  3) Unregister quartz.dll.

  Impact of workaround #3: Windows Media Player will not be able to play .AVI or .WAV files.

  Refer to the advisory to obtain additional details on applying the workarounds.

• Microsoft Office Word Remote Code Execution Vulnerability (MS10-056)

  Severity

  Critical 4

  Qualys ID

  110129

  Vendor Reference

  MS10-056

  CVE Reference

  CVE-2010-1900, CVE-2010-1901, CVE-2010-1902, CVE-2010-1903

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft Word is a proprietary word processing application written and distributed by Microsoft for Microsoft Windows and Mac OS X. Word is prone to the following vulnerabilities:

  A remote code execution vulnerability exists in the way that Microsoft Office Word handles malformed records inside a specially crafted Word file. (CVE-2010-1900)

  A remote code execution vulnerability exists in the way that Microsoft Office Word parses rich text data. (CVE-2010-1901,CVE-2010-1902)

  A remote code execution vulnerability exists in the way that Microsoft Office Word handles a specially crafted Word file that includes a malformed record. (CVE-2010-1903)

  Microsoft has released an update that addresses the vulnerabilities by modifying the way that Microsoft Office Word opens specially crafted Word files and by modifying the way that Word handles certain properties of rich text data.

  This security update is rated Critical for all supported editions of Microsoft Office Word 2007. This security update is also rated Important for all supported editions of Microsoft Office Word 2002, Microsoft Office Word 2003, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac; Open XML File Format Converter for Mac; Works 9; and all supported versions of Microsoft Office Word Viewer and Microsoft Office Compatibility Pack.

  Consequence

  An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office XP Service Pack 3 (Microsoft Office Word 2002 Service Pack 3)

  Microsoft Office 2003 Service Pack 3 (Microsoft Office Word 2003 Service Pack 3)

  2007 Microsoft Office System Service Pack 2 (Microsoft Office Word 2007 Service Pack 2)

  Microsoft Office 2004 for Mac

  Microsoft Office 2008 for Mac

  Open XML File Format Converter for Mac

  Microsoft Office Word Viewer

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2

  Microsoft Works 9

  Refer to Microsoft Security Bulletin MS10-056 for further details.

  Workarounds:
  1) Avoid opening Word files received from un-trusted sources.

  2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or un-trusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

  Impact of workaround #2:
  Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

  3) Microsoft Office File Block policy should be used to block the opening of RTF and earlier documents from unknown or untrusted sources.

  Impact of the workaround #3:
  If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

  4) Read e-mails in plain text.

  Refer to the advisory to obtain additional details on applying the workarounds.

• Microsoft Excel Remote Code Execution Vulnerabilities (MS10-057)

  Severity

  Critical 4

  Qualys ID

  110130

  Vendor Reference

  MS10-057

  CVE Reference

  CVE-2010-2562

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft.

  Microsoft Excel is vulnerable to a remote code execution vulnerability due to a memory corruption issue. This can occur if the user opens a specially crafted Excel file.

  Microsoft has released an update that addresses the vulnerability by changing the way that Microsoft Office Excel parses specially crafted Excel files.

  This security update is rated Important for all supported editions of Microsoft Office Excel 2002, Microsoft Office Excel 2003, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac; and Open XML File Format Converter for Mac.

  Consequence

  Successful exploitation allows remote code execution. An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office XP Service Pack 3 (Microsoft Office Excel 2002 Service Pack 3)

  Microsoft Office 2003 Service Pack 3 (Microsoft Office Excel 2003 Service Pack 3)

  Microsoft Office 2004 for Mac

  Microsoft Office 2008 for Mac

  Open XML File Format Converter for Mac

  Refer to Microsoft Security Bulletin MS10-057 for further details.

  Workaround:
  1) Avoid opening Office files received from un-trusted sources.

  2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or un-trusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

  Impact of the workaround:
  Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

  3) Microsoft Office File Block policy should be used to block the opening of Office 2003 and earlier documents from unknown or untrusted sources.

  Impact of the workaround:
  If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

  Refer to the advisory for obtaining additional details on applying the workarounds.

• Microsoft Windows TCP/IP Elevation of Privilege Vulnerability (MS10-058)

  Severity

  Critical 4

  Qualys ID

  90620

  Vendor Reference

  MS10-058

  CVE Reference

  CVE-2010-1892, CVE-2010-1893

  CVSS Scores

  Base 7.8 / Temporal 5.8

  Description

  TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. The following vulnerabilities exist in TCP/IP processing in Windows.

  A denial of service vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of specially crafted IPv6 packets with a malformed extension header. An attacker could exploit the vulnerability by sending the target system a small number of specially crafted packets, causing the affected system to stop responding. (CVE-2010-1892)

  An elevation of privilege vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of a specific input buffer. An attacker who successfully exploited this vulnerability could run arbitrary code with system-level privileges. (CVE-2010-1893)

  Affected Operating Systems:
  Windows Vista Service Pack 1 and Windows Vista Service Pack 2
  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2
  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2
  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2
  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2
  Windows 7 for 32-bit Systems
  Windows 7 for x64-based Systems
  Windows Server 2008 R2 for x64-based Systems
  Windows Server 2008 R2 for Itanium-based Systems

  Consequence

  An attacker who successfully exploits this vulnerability could run arbitrary code with system-level privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS10-058 for further details.

• Microsoft Windows Tracing Feature for Services Privilege Elevation Vulnerability (MS10-059)

  Severity

  Serious 3

  Qualys ID

  90628

  Vendor Reference

  MS10-059

  CVE Reference

  CVE-2010-2554, CVE-2010-2555

  CVSS Scores

  Base 6.8 / Temporal 5.6

  Description

  The Windows Tracing Feature for Services is vulnerable to the following vulnerabilities:

  An elevation of privilege vulnerability exists when Windows places incorrect access control lists (ACLs) on the registry keys for the Tracing Feature for Services. (CVE-2010-2554)

  An elevation of privilege vulnerability exists due to the way that the Tracing Feature for Services allocates memory when processing specially crafted long strings from the registry. (CVE-2010-2555)

  Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which tokens are obtained and the length of a string read from the registry is calculated.

  This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

  Consequence

  An attacker who successfully exploits these vulnerabilities could run arbitrary code with system-level privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista Service Pack 1 and Windows Vista Service Pack 2

  Windows Vista x64 Edition Service Pack 1 and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Windows 7 for 32-bit Systems

  Windows 7 for x64-based Systems

  Windows Server 2008 R2 for x64-based Systems

  Windows Server 2008 R2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS10-059 for further details.

• Microsoft .NET Common Language Runtime and Silverlight Remote Code Execution Vulnerabilities (MS10-060)

  Severity

  Urgent 5

  Qualys ID

  90624

  Vendor Reference

  MS10-060

  CVE Reference

  CVE-2010-0019, CVE-2010-1898

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Microsoft .NET Framework and Microsoft Silverlight are exposed to two vulnerabilities.

  The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications, or if an attacker succeeds in convincing a user to run a specially crafted Microsoft .NET application.

  The vulnerabilities could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and executing the page, as could be the case in a Web hosting scenario.

  Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Microsoft Silverlight handles pointers and Microsoft .NET CLR handles interfaces.

  This security update is rated Critical for all affected releases of Microsoft .NET Framework for Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2; Microsoft Silverlight 2; and Microsoft Silverlight 3.

  Windows Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB2265906, 983582, 983583)
  

  Consequence

  Successful exploitation of this vulnerability allows an attacker to execute arbitrary code.

  Solution

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS10-060.

  Workaround:
  1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.

  2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

  Impact of workaround #1 and #2:
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

  3) Temporarily prevent the Microsoft Silverlight ActiveX control from running in Internet Explorer, Chrome and Firefox.

  Impact of workaround #3: Applications and Web sites that require the Microsoft Silverlight ActiveX control may no longer function correctly.

  4) Disable partially trusted Microsoft .NET applications.

  Impact of workaround #4: Some Microsoft .NET applications will not run.

  5) Disable XAML browser applications in Internet Explorer.

  Impact of workaround #5: Impact of workaround. Microsoft .NET code will not run in Internet Explorer or will not run without a prompt.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS10-060 Microsoft Silverlight 2
  MS10-060 Microsoft Silverlight 2
  MS10-060 Microsoft Silverlight 2
  MS10-060 Microsoft Silverlight 3
  MS10-060 Microsoft Silverlight 3
  MS10-060 Microsoft Silverlight 3
  MS10-060 Windows 7 for 32-bit Systems(Microsoft .NET Framework 3.5.1)
  MS10-060 Windows 7 for x64-based Systems(Microsoft .NET Framework 3.5.1)
  MS10-060 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2003 Service Pack 2(Microsoft .NET Framework 3.5)
  MS10-060 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2003 with SP2 for Itanium-based Systems(Microsoft .NET Framework 3.5)
  MS10-060 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2003 x64 Edition Service Pack 2(Microsoft .NET Framework 3.5)
  MS10-060 Windows Server 2008 R2 for Itanium-based Systems(Microsoft .NET Framework 3.5.1)
  MS10-060 Windows Server 2008 R2 for x64-based Systems(Microsoft .NET Framework 3.5.1)
  MS10-060 Windows Server 2008 for 32-bit Systems(Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5)
  MS10-060 Windows Server 2008 for 32-bit Systems(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2008 for 32-bit Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2008 for Itanium-based Systems(Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5)
  MS10-060 Windows Server 2008 for Itanium-based Systems(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2008 for Itanium-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2008 for x64-based Systems(Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5)
  MS10-060 Windows Server 2008 for x64-based Systems(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Server 2008 for x64-based Systems Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Vista Service Pack 1(Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5)
  MS10-060 Windows Vista Service Pack 1(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Vista Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Vista x64 Edition Service Pack 1(Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5)
  MS10-060 Windows Vista x64 Edition Service Pack 1(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows Vista x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows XP Professional x64 Edition Service Pack 2(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows XP Professional x64 Edition Service Pack 2(Microsoft .NET Framework 3.5)
  MS10-060 Windows XP Service Pack 3(Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1)
  MS10-060 Windows XP Service Pack 3(Microsoft .NET Framework 3.5)

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.