Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 8 vulnerabilities that were fixed in 5 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 5 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Windows Media Format Remote Code Execution Vulnerability (MS09-047)

  Severity

  Critical 4

  Qualys ID

  90524

  Vendor Reference

  MS09-047

  CVE Reference

  CVE-2009-2498, CVE-2009-2499

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Windows Media Format Runtime provides information and tools for applications that use Windows Media content. The following vulnerabilities exist in the way Microsoft Windows processes media files.

  - The Windows component responsible for processing Advanced Systems Format (ASF) files does not properly handle specially crafted ASF files with malformed headers. An attacker can exploit this issue by enticing an unsuspecting user into opening a specially crafted ASF file or by sending specially crafted streaming content from a Web site or any application that delivers Web content. (CVE-2009-2498)

  - A remote code execution vulnerability exists because the Windows component responsible for processing MPEG-1 Audio Layer 3 (MP3) files does not properly handle specially crafted metadata. Exploitation of this vulnerability requires that a user opens a specially crafted MP3 file or receives specially crafted streaming content from a Web site or any application that delivers Web content. (CVE-2009-2499)

  Microsoft has released a security update that addresses these vulnerabilities by modifying the way that Windows Media Format Runtime parses Advanced Systems Format (ASF) files and MPEG-1 Audio Layer 3 (MP3) files.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  September Security Updates and Optional Updates are Available on ECE (KB973812)
  October 2009 Security Database Updates are Available (KB973812)
  April 2010 Security Updates for Standard 2009 and XPe are Available on ECE (KB968816, KB973812)
  August 2010 Security Updates for XPe and Standard 2009 Available on ECE (KB968816)
  

  Consequence

  Successful exploitation of either vulnerability could allow remote code execution if a user opened a specially crafted media file. If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 (Windows Media Format Runtime 9.0)

  Windows XP Service Pack 2 (Windows Media Format Runtime 9.0, Windows Media Format Runtime 9.5, and Windows Media Format Runtime 11)

  Windows XP Service Pack 3 (Windows Media Format Runtime 9.0, Windows Media Format Runtime 9.5, and Windows Media Format Runtime 11)

  Windows XP Professional x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5)

  Windows XP Professional x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5 x64 Edition)

  Windows XP Professional x64 Edition Service Pack 2 (Windows Media Format Runtime 11)

  Windows Server 2003 Service Pack 2 (Windows Media Format Runtime 9.5)

  Windows Server 2003 x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5)

  Windows Server 2003 x64 Edition Service Pack 2 (Windows Media Format Runtime 9.5 x64 Edition)

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 (Windows Media Format Runtime 11 and Microsoft Media Foundation)

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 (Windows Media Format Runtime 11 and Microsoft Media Foundation)

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 (Windows Media Format Runtime 11 and Microsoft Media Foundation)

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 (Windows Media Format Runtime 11 and Microsoft Media Foundation)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-047.

  Workaround:
  - Restrict access to wmvcore.dll and mf.dll

  Impact of workaround: Media files cannot be played in Windows Explorer or in Windows Media Player. Windows Media Player may exit with an error.

  Detailed information on enabling and disabling the workarounds can be found at Microsoft Security Bulletin MS09-047.

• Microsoft JScript Scripting Engine Remote Code Execution Vulnerability (MS09-045)

  Severity

  Critical 4

  Qualys ID

  90522

  Vendor Reference

  MS09-045

  CVE Reference

  CVE-2009-1920

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  JScript is an interpreted, object-based scripting language that is often used to make Web sites more flexible or interactive.

  A remote code execution vulnerability is caused by the way that the JScript scripting engine processes scripts in Web pages. When the JScript scripting engine attempts to load the decoded script into memory in order to run it, a memory corruption can occur that may either cause Internet Explorer to stop responding or lead to code execution. (CVE-2009-1920)

  Microsoft has released a security update to address the vulnerability by modifying the way that the JScript engine processes scripts in Web pages.

  This security update is rated "Critical" for JScript 5.1 on Microsoft Windows 2000 Service Pack 4 and "Critical" for JScript 5.6, JScript 5.7 and JScript 5.8 on all supported releases of the Windows operating system except Windows 7 and Windows Server 2008 R2.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  September Security Updates and Optional Updates are Available on ECE (KB971961)
  October 2009 Security Database Updates are Available (KB971961)
  

  Consequence

  Successful exploitation of these vulnerabilities could allow remote code execution if a user opens a specially crafted file or visits a specially crafted Web site and invokes a malformed script. If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 (JScript 5.1 and JScript 5.6)

  Microsoft Windows 2000 Service Pack 4 (JScript 5.7)

  Windows XP Service Pack 2 (JScript 5.6)

  Windows XP Service Pack 2 (JScript 5.7)

  Windows XP Service Pack 3 (JScript 5.7)

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (JScript 5.8)

  Windows XP Professional x64 Edition Service Pack 2 (JScript 5.6)

  Windows XP Professional x64 Edition Service Pack 2 (JScript 5.7)

  Windows XP Professional x64 Edition Service Pack 2 (JScript 5.8)

  Windows Server 2003 Service Pack 2 (JScript 5.6)

  Windows Server 2003 Service Pack 2 (JScript 5.7)

  Windows Server 2003 Service Pack 2 (JScript 5.8)

  Windows Server 2003 x64 Edition Service Pack 2 (JScript 5.6)

  Windows Server 2003 x64 Edition Service Pack 2 (JScript 5.7)

  Windows Server 2003 x64 Edition Service Pack 2 (JScript 5.8)

  Windows Server 2003 with SP2 for Itanium-based Systems (JScript 5.6)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-045.

  Workaround:
  - Set Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.
  - Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local Intranet security zones.

  Detailed steps on applying the workarounds can be found at Microsoft Security Bulletin MS09-045.

  Impact of the Workaround -
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

• Microsoft DHTML Editing Component ActiveX Control Remote Code Execution Vulnerability (MS09-046)

  Severity

  Critical 4

  Qualys ID

  90523

  Vendor Reference

  MS09-046

  CVE Reference

  CVE-2009-2519

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  The DHTML Editing Component ActiveX control supports dynamic Web site HTML editing.

  It is vulnerable to a remote code execution issue when the Microsoft DHTML Editing Component ActiveX Control is instantiated in Internet Explorer. An attacker could exploit the vulnerability by constructing a malicious Web page that allows remote code execution if an unsuspecting user visits that page. (CVE-2009-2519)

  Microsoft has released a security update that addresses the vulnerability by revising the way that the ActiveX control formats HTML markup.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  September Security Updates and Optional Updates are Available on ECE (KB956844)
  October 2009 Security Database Updates are Available (KB956844)
  

  Consequence

  Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code with the privileges of the user who is logged-on.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4

  Windows XP Service Pack 2 and Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS09-046 for further details.

  Workarounds:
  1) Prevent the DHTML ActiveX control COM object from running in Internet Explorer by setting the kill bit for the control in the registry. Refer to Microsoft article KB240797 for information on setting the kill bit.

  Impact of workaround #1: There is no impact because the DHTML ActiveX control COM object is not intended to be used in Internet Explorer.

  2) Set Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.

  3) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local Intranet security zones.

  Impact of workarounds #2 and #3:
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

  Detailed instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-046.

• Microsoft Windows TCP/IP Remote Code Execution Vulnerabilities (Windows 2003, 2008, Vista) (MS09-048)

  Severity

  Critical 4

  Qualys ID

  90525

  Vendor Reference

  MS09-048

  CVE Reference

  CVE-2008-4609, CVE-2009-1925, CVE-2009-1926

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  TCP/IP is a set of networking protocols that are widely used on the Internet. The following vulnerabilities exist in the Windows TCP/IP stack.

  - A denial of service vulnerability exists because the Windows TCP/IP stack does not properly handle large numbers of established TCP connections. If these established connections are abused by a remote system requesting data and setting the TCP receive window size to a small or a zero value, the denial of service condition can be amplified. (CVE-2008-4609)

  - A remote code execution vulnerability is caused by the Windows TCP/IP stack not cleaning up state information correctly. This causes the TCP/IP stack to reference a field as a function pointer when it actually contains other information. (CVE-2009-1925)

  - A denial of service vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of specially crafted packets with a small or zero TCP receive window size. An attacker could exploit the vulnerability by flooding a system with specially crafted packets causing the affected system to stop responding to new requests. (CVE-2009-1926)

  Microsoft has released a security update that addresses these vulnerabilities by dropping existing TCP connections adaptively and limiting the number of new TCP connections until system resources are restored, and changing the manner in which TCP/IP packets are processed.

  Consequence

  Successful exploitation of these vulnerabilities can be exploited to cause denial of service conditions or execute arbitrary code on the system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS09-048 for further details.

  Workaround:
  - To help protect from network-based attempts to exploit this vulnerability the following workarounds can be applied.

  1) Enable advanced TCP/IP filtering on systems that support this feature to block all unsolicited inbound traffic. Additional information on configuring TCP/IP filtering can be found in the Microsoft Knowledge Base Article 309798.

  2) Use a personal firewall, such as the Internet Connection Firewall.

  To obtain additional details on applying the workarounds, please refer to Microsoft Security Bulletin MS09-048.

• Microsoft Windows Wireless LAN AutoConfig Service Allow Remote Code Execution Vulnerability (MS09-049)

  Severity

  Critical 4

  Qualys ID

  90526

  Vendor Reference

  MS09-049

  CVE Reference

  CVE-2009-1132

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  WLAN AutoConfig is a service that configures wireless security and connectivity settings.

  The Windows Wireless LAN AutoConfig Service (WLANSVC) fails to validate hidden SSID information elements in access point beacons. A malicious access point (or host functioning as an access point) could use this to cause arbitrary code to be executed with the privileges of the user running the WLANSVC. (CVE-2009-1132)

  Microsoft has released a security update that addresses the vulnerability by extending the Wireless LAN AutoConfig service to properly validate wireless frames prior to processing them.

  Consequence

  Successful exploitation of this vulnerability results in complete remote system compromise if the user is running with administrator permissions, or account compromise if the user is running with reduced privileges.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS09-049 for further details.

  Workaround:
  - Unregister Wlansvc: To modify the registry key, perform the following steps:

  Using the Interactive Method
  1) Click Start, click Run, type Regedit in the Open box, and then click OK. 2) Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services 3) Click Wlansvc. 4) Click the File menu and select Export. 5) In the Export Registry File dialog box, enter Wlansvc_configuration_backup.reg and click Save.
  Note: This will create a backup of this registry key in the My Documents folder by default.
  6) Double-click the Start value and change the Value data field to 4.
  7) Click OK.
  8) Run the following command from a command prompt as an administrator:
  sc stop Wlansvc

  Using a Managed Deployment Script
  1) Create a backup copy of the registry keys by using a managed deployment script that contains the following commands:
  Regedit.exe /e Wlansvc_configuration_backup.reg
  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Wlansvc
  2) Save the following to a file with a .REG extension, such as Disable_Wlansvc.reg:
  Windows Registry Editor Version 5.00
  [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Wlansvc] "Start"=dword:00000004 3) Run the above registry script on the target machine with the following command:
  Regedit.exe /s Disable_Wlansvc.reg
  4) Run the following command from a command prompt as an administrator:
  sc stop Wlansvc
  

  Impact of workaround: Wireless networking will not be available.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.