Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 15 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Windows Kernel-Mode Drivers Remote Code Execution Vulnerability (MS09-065)

  Severity

  Urgent 5

  Qualys ID

  90566

  Vendor Reference

  MS09-065

  CVE Reference

  CVE-2009-1127, CVE-2009-2513, CVE-2009-2514

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling.

  Windows kernel is prone to the following vulnerabilities:

  - An elevation of privilege vulnerability exists in Windows kernel that is caused by the Windows kernel not properly validating an argument passed to a Windows kernel system call. (CVE-2009-1127)

  - An elevation of privilege vulnerability exists in Windows kernel-mode drivers due to improper validation of input passed from user mode through the kernel component of GDI. (CVE-2009-2513)

  - A remote code execution vulnerability exists in the Windows kernel-mode drivers due to the improper parsing of font code when building a table of directory entries. (CVE-2009-2514)

  Microsoft has released a security update that addresses these vulnerabilities by correcting the method used for validating the argument passed to the system call, validating input passed from user mode through the kernel component of GDI, and correcting the manner in which Windows kernel-mode drivers parse font code.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  November 2009 Runtime Security Updates for XPe and Standard 2009 are Now Available (KB969947)
  

  Consequence

  An attacker who successfully exploited these vulnerabilities could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4

  Windows XP Service Pack 2 and Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS09-065 for further details.

  Workaround:
  

  For CVE-2009-2514:
  1) Disable support for parsing embedded fonts in Internet Explorer. Microsoft has provided an automated Microsoft Fix solution to enable or disable this workaround. Refer to KB969947 for the automated solution.

  Impact of workaround #1:
  Web sites making use of embedded font technology will fail to display properly.

  2) Deny Access to T2EMBED.DLL

  Impact of workaround #2:
  Applications that rely on embedded font technology will fail to display properly.

  To obtain additional details on enabling and disabling the workarounds, please refer to Microsoft Security Bulletin MS09-065.

• Microsoft Web Services on Devices API Remote Code Execution Vulnerabilities (MS09-063)

  Severity

  Critical 4

  Qualys ID

  90565

  Vendor Reference

  MS09-063

  CVE Reference

  CVE-2009-2512

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Microsoft Web Services on Devices allows a Windows client to discover and access remote devices.

  A remote code execution vulnerability exists in the Web Services on Devices API (WSDAPI) on Windows systems. The vulnerability is caused by the WSDAPI, on both clients and servers, because it does not correctly validate specific headers of a received WSD message. (CVE-2009-2512)

  Microsoft has released a security update to addresses this vulnerability by correcting the processing of headers in WSD messages. This security update is rated Critical for all supported editions of Windows Vista and Windows Server 2008.

  Consequence

  Successful exploitation of this vulnerability allows an attacker to take complete control of an affected system remotely. The attacker could then install programs or view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS09-063 for further details.

  Workaround:
  Configure the Windows Firewall to block inbound TCP ports 5357 and 5358, and outbound UDP port 3702. Blocking the inbound ports prevents malicious remote hosts from sending specially crafted headers to the affected component.

  Impact of the workaround:
  Device discovery will not work while this workaround is enabled.

• Microsoft Windows License Logging Server Remote Code Execution Vulnerability (MS09-064)

  Severity

  Critical 4

  Qualys ID

  90567

  Vendor Reference

  MS09-064

  CVE Reference

  CVE-2009-2523

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  Microsoft's License Logging service is a tool that helps customers manage licenses for the Microsoft server products within the Server Client Access License model.

  The service is vulnerable to remote code execution since it fails to validate the length of a string passed through an RPC call. (CVE-2009-2523)

  Microsoft Windows 2000 is vulnerable.

  Microsoft has released a security update that addresses the vulnerability by changing the way the License Logging service validates a specific field inside the RPC packet.

  Consequence

  An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Server Service Pack 4

  Refer to Microsoft Security Bulletin MS09-064 for further details.

  Workarounds:

  1) Disable the License Logging service. To do this, perform the following steps:
  - Click Start, and then click Control Panel.
  - Double-click Administrative Tools.
  - Double-click Services.
  - Double-click License Logging Service.
  - In the Startup type list, click Disabled.
  - Click Stop, and then click OK.

  Impact of workaround #1:
  If the License Logging service is disabled, any services that explicitly depend on the License Logging service may log an error message in the system event log.

  2) TCP ports 139 and 445 should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability.

  Impact of workaround #2:
  Blocking the ports can cause several windows services or applications using those ports to stop functioning.

• Microsoft Active Directory Denial of Service Vulnerability (MS09-066)

  Severity

  Urgent 5

  Qualys ID

  90568

  Vendor Reference

  MS09-066

  CVE Reference

  CVE-2009-1928

  CVSS Scores

  Base 7.8 / Temporal 6.1

  Description

  Active Directory provides central authentication and authorization services for Windows-based computers. Active Directory Lightweight Directory Services (AD LDS) is an independent mode of Active Directory that provides dedicated directory services for applications. AD LDS is available in Windows Server 2008 and later, and replaces Active Directory Application Mode (ADAM), which was available in Windows XP and Windows Server 2003.

  - A denial of service vulnerability exists in implementations of Active Directory on Microsoft Windows 2000 Server, Windows Server 2003, and Windows Server 2008. The vulnerability also exists in implementations of ADAM when installed on Windows XP and Windows Server 2003, and AD LDS on Windows Server 2008. The vulnerability is due to stack space exhaustion during execution of certain types of LDAP or LDAPS requests. (CVE-2009-1928)

  Microsoft has released a security update that addresses the vulnerability by changing the way Active Directory, ADAM, and AD LDS process malformed LDAP or LDAPS requests.

  Consequence

  An attacker who successfully exploited this vulnerability could cause the affected system to stop responding.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Server Service Pack 4 (Active Directory)

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Active Directory Application Mode (ADAM))

  Windows XP Professional x64 Edition Service Pack 2 (Active Directory Application Mode (ADAM))

  Windows Server 2003 Service Pack 2 (Active Directory)

  Windows Server 2003 Service Pack 2 (Active Directory Application Mode )

  Windows Server 2003 x64 Edition Service Pack 2 (Active Directory)

  Windows Server 2003 x64 Edition Service Pack 2 (Active Directory Application Mode )

  Windows Server 2003 with SP2 for Itanium-based Systems (Active Directory)

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Active Directory and Active Directory Lightweight Directory Service (AD LDS))

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Active Directory and Active Directory Lightweight Directory Service (AD LDS))

  Refer to Microsoft Security Bulletin MS09-066 for further details.

  Workaround:
  - Block TCP ports 389, 636, 3268 and 3269 at the firewall. These ports are used to initiate a connection with the affected component. Blocking them at the enterprise firewall, both inbound and outbound, will help prevent systems that are behind that firewall from attempts to exploit this vulnerability.

• Microsoft Office Excel Remote Code Execution Vulnerabilities (MS09-067)

  Severity

  Critical 4

  Qualys ID

  110096

  Vendor Reference

  MS09-067

  CVE Reference

  CVE-2009-3127, CVE-2009-3128, CVE-2009-3129, CVE-2009-3130, CVE-2009-3131, CVE-2009-3132, CVE-2009-3133, CVE-2009-3134

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft for Microsoft Windows and Mac OS X. Excel is prone to the following vulnerabilities:

  A remote code execution vulnerability exists in the way that Microsoft Office Excel handles specially crafted Excel files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3127).

  A remote code execution vulnerability exists in the way Microsoft Office Excel handles specially crafted Excel files that include a malformed record object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3128)

  A remote code execution vulnerability exists in the way that Microsoft Office Excel handles specially crafted Excel files that include a malformed record object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3129)

  A remote code execution vulnerability exists in the way Microsoft Office Excel handles specially crafted Excel files with malformed BIFF records. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3130)

  A remote code execution vulnerability exists in the way that Microsoft Office Excel parses documents containing a specially crafted formula embedded inside a cell. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3131)

  A remote code execution vulnerability exists in Microsoft Office Excel as a result of pointer corruption when loading Excel formulas. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed formula. An attacker who successfully exploited this vulnerability could take complete control of an affected system. (CVE-2009-3132)

  A remote code execution vulnerability exists in Microsoft Office Excel as a result of memory corruption when loading Excel records. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed object. An attacker who successfully exploited this vulnerability could take complete control of an affected system.(CVE-2009-3133)

  A remote code execution vulnerability exists in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed record object. An attacker who successfully exploited this vulnerability could take complete control of an affected system.(CVE-2009-3134)

  Microsoft has released a security update that addresses these vulnerabilities by modifying the way that Excel opens and parses Excel files, and by modifying the way that Excel handles malformed records.

  Previously, this was an iDefense Exclusive vulnerability.
  Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.For details see: http://www.qualys.com/research/exploits/#MS09-067

  Consequence

  Successful exploitation of these vulnerabilities will allow a remote attacker to run arbitrary code as the logged on user. An attacker with administrative rights can take complete control of the affected system and then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office XP Service Pack 3 (Microsoft Office Excel 2002 Service Pack 3)

  Microsoft Office 2003 Service Pack 3 (Microsoft Office Excel 2003 Service Pack 3)

  2007 Microsoft Office System Service Pack 1 and 2007 Microsoft Office System Service Pack 2 (Microsoft Office Excel 2007 Service Pack 1 and Microsoft Office Excel 2007 Service Pack 2)

  Microsoft Office 2004 for Mac

  Microsoft Office 2008 for Mac

  Open XML File Format Converter for Mac

  Microsoft Office Excel Viewer 2003 Service Pack 3

  Microsoft Office Excel Viewer Service Pack 1 and Microsoft Office Excel Viewer Service Pack 2

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1 and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2

  Refer to Microsoft Security Bulletin MS09-067 for further details.

  Workarounds:
  1) Avoid opening Office files received from untrusted sources.

  2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or untrusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

  Impact of workaround #2:
  Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

  3) Microsoft Office File Block policy should be used to block the opening of Office 2003 and earlier documents from unknown or untrusted sources. The following registry scripts can be used to set the File Block policy.
  Note: Modifying the Registry incorrectly can cause serious problems that may require re-installation of the operating system.

  For Office 2003:
  Windows Registry Editor Version 5.00
  [HKEY_CURRENT_USER\Software\Microsoft\Office.0\Excel\Security\FileOpenBlock]
  "BinaryFiles"=dword:00000001

  For 2007 Office system:
  Windows Registry Editor Version 5.00
  [HKEY_CURRENT_USER\Software\Microsoft\Office.0\Excel\Security\FileOpenBlock]
  "BinaryFiles"=dword:00000001

  Impact of workaround #3:
  If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

• Microsoft Office Word Remote Code Execution Vulnerabilities (MS09-068)

  Severity

  Critical 4

  Qualys ID

  110111

  Vendor Reference

  MS09-068

  CVE Reference

  CVE-2009-3135

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Word is a proprietary word processing application written and distributed by Microsoft for Microsoft Windows and Mac OS X.

  A remote code execution vulnerability exists in the way that Microsoft Office Word handles a specially crafted Word file that includes a malformed record. An attacker can entice an unsuspecting user into opening a maliciously crafted Word file which may corrupt system memory in such a way that arbitrary code can be executed. (CVE-2009-3135)

  Microsoft has released an update that addresses the vulnerabilities by modifying the way that Word opens files.

  Consequence

  An attacker who successfully exploits these vulnerabilities can execute arbitrary code and take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office XP Service Pack 3 (Microsoft Office Word 2002 Service Pack 3)

  Microsoft Office 2003 Service Pack 3 (Microsoft Office Word 2003 Service Pack 3)

  Microsoft Office 2004 for Mac

  Microsoft Office 2008 for Mac

  Open XML File Format Converter for Mac

  Microsoft Office Word Viewer 2003 Service Pack 3

  Microsoft Office Word Viewer

  Refer to Microsoft Security Bulletin MS09-068 for further details.

  Workarounds:
  1) Avoid opening Office files received from untrusted sources.

  2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or untrusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

  Impact of workaround #2:
  Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.