Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 19 vulnerabilities that were fixed in 9 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 9 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Windows ASP.NET Denial of Service Vulnerability (MS09-036)

  Severity

  Serious 3

  Qualys ID

  90520

  Vendor Reference

  MS09-036

  CVE Reference

  CVE-2009-1536

  CVSS Scores

  Base 2.6 / Temporal 1.9

  Description

  ASP.NET is a collection of technologies within the .NET Framework that allows developers to build Web applications and XML Web services.

  ASP.NET is vulnerable to a denial of service vulnerability due to the way it manages request scheduling. An attacker could exploit this vulnerability by creating a specially crafted series of anonymous HTTP requests to an affected system and thereby cause the Web server running on this system to become non-responsive. (CVE-2009-1536)

  Microsoft has released a security update that addresses this vulnerability by changing the way ASP.NET manages request scheduling.

  Consequence

  Successful exploitation of these vulnerabilities allows an attacker to cause a denial of service by creating crafted HTTP requests.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

  Windows Vista (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

  Windows Vista Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

  Windows Vista Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

  Windows Vista x64 Edition (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

  Windows Vista x64 Edition (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

  Windows Vista x64 Edition Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

  Windows Vista x64 Edition Service Pack 1 (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

  Windows Server 2008 for 32-bit Systems (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

  Windows Server 2008 for 32-bit Systems (Microsoft .NET Framework 2.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1 )

  Windows Server 2008 for x64-based Systems (Microsoft .NET Framework 2.0 Service Pack 1 and Microsoft .NET Framework 3.5 )

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-036.

  Workaround:
  - Switch to the IIS native thread pool. This can be done by the following two methods:

  Method 1: Specify the value for maxConcurrentRequestsPerCPU in the registry. This setting is global and affects all application pools.

  Method 2: Specify the value for maxConcurrentRequestsPerCPU for an application pool in the ASP.NET config section of an ASPNET.Config file. This setting allows configuration for individual application pools

  Impact of workaround: Depending on the nature of applications running in this application pool, application performance may be affected.

  For detailed instructions on applying the workarounds, please refer to the Workaround section at Microsoft Security Bulletin MS09-036.

• Microsoft Telnet Remote Code Execution Vulnerability (MS09-042)

  Severity

  Medium 2

  Qualys ID

  42020

  Vendor Reference

  MS09-042

  CVE Reference

  CVE-2009-1930

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  Telnet is a bidirectional communications protocol that allows for command line remote access over the TCP protocol.

  Microsoft Telnet is vulnerable to a remote code execution issue because the telnet protocol does not correctly opt in to the NTML credential reflection protections. An attacker would have to host a specially crafted Telnet server and entice an unsuspecting user into visiting the malicious server to exploit this vulnerability. (CVE-2009-1930)

  Microsoft has released a security update that addresses the vulnerability by modifying the way that the Telnet service validates authentication replies in order to prevent the relay of credentials.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB960859)
  

  Consequence

  Successful exploitation of these vulnerabilities allows an attacker to run arbitrary code as the logged-on user. An attacker with administrative rights can take complete control of the affected system and then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4

  Windows XP Service Pack 2 and Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS09-042 for further details.

• Microsoft Remote Desktop Connection Remote Code Execution Vulnerability (MS09-044)

  Severity

  Critical 4

  Qualys ID

  116552

  Vendor Reference

  MS09-044

  CVE Reference

  CVE-2009-1133, CVE-2009-1929

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Remote Desktop Protocol (RDP) provides remote display and input capabilities over network connections for Microsoft Windows-based applications running on a server. The Remote Desktop Web Connection ActiveX control allows access to a computer, via the Internet, from another computer using Internet Explorer.

  - A remote code execution vulnerability exists in the way that Microsoft Remote Desktop Connection processes specific parameters returned by the RDP server. This issue results in a heap overflow on the client. An attacker could convince a user to connect to a malicious RDP server, or could perform a man-in-the-middle attack and subsequently exploit this vulnerability on the Remote Desktop Connection client. (CVE-2009-1133)

  - A remote code execution vulnerability exists because the Remote Desktop Web Connection ActiveX control methods do not perform sufficient parameter validation. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could potentially allow remote code execution if a user visited that page. (CVE-2009-1929)

  Microsoft has released a security update that addresses these vulnerabilities by changing the way the Remote Desktop Connection deals with unexpected parameters sent by the RDP server and by correctly validating parameters passed to the Remote Desktop Connection ActiveX control methods.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB970927, 956744, 958470)
  

  Consequence

  Successful exploitation of these vulnerabilities allows an attacker to run arbitrary code as the logged-on user. An attacker with administrative rights can take complete control of the affected system and then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 (RDP Version 5.0 )

  Microsoft Windows 2000 Service Pack 4 (RDP Version 5.0 )

  Microsoft Windows 2000 Service Pack 4 (RDP Version 5.1 )

  Microsoft Windows 2000 Service Pack 4 (RDP Version 5.2 )

  Windows XP Service Pack 2 (RDP Version 5.1 )

  Windows XP Service Pack 2 (RDP Version 5.2 )

  Windows XP Service Pack 2 (RDP Version 6.1 )

  Windows XP Service Pack 2 (RDP Version 6.0)

  Windows XP Service Pack 3 (RDP Version 6.1 )

  Windows XP Service Pack 3 (RDP Version 5.2 )

  Windows XP Professional x64 Edition Service Pack 2 (RDP Version 5.2)

  Windows XP Professional x64 Edition Service Pack 2 (RDP Version 6.1)

  Windows Server 2003 Service Pack 2 (RDP Version 5.2)

  Windows Server 2003 Service Pack 2 (RDP Version 6.0)

  Windows Server 2003 x64 Edition Service Pack 2 (RDP Version 5.2)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-044.

  Workarounds:
  For CVE-2009-1133:
  1) Restrict access to mstscax.dll.

  Impact of workaround #1: You will not be able to make outbound Remote Desktop connections.

  For CVE-2009-1929:
  1) Prevent the Remote Desktop Connection ActiveX control from running in Internet Explorer by setting the kill bit for the control in the registry.

  Impact of workaround #1. Users will not be able to start remote desktop connections from within Web pages.

  2) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting in these zones.

  3) Configure Internet Explorer to prompt before running ActiveX controls or disable ActiveX controls in the Internet and Local intranet security zones.

  Impact of workarounds #2 and #3: On visting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

• Microsoft Workstation Service Elevation of Privilege Vulnerability (MS09-041)

  Severity

  Critical 4

  Qualys ID

  90519

  Vendor Reference

  MS09-041

  CVE Reference

  CVE-2009-1544

  CVSS Scores

  Base 9 / Temporal 7

  Description

  The Workstation service is a Windows component that supports the routing of remote file and network print resource requests.

  - An elevation of privilege vulnerability exists in the Workstation service due to the "Double Free" condition occurring in the service. A double free condition is a condition in which a program is caused to release or free allocated memory more than once. Releasing memory that has already been freed could lead to memory corruption. An attacker could exploit the vulnerability by creating a specially crafted RPC message and sending the message to an affected system. The message could then allow an authenticated client to write arbitrary data to memory in the Workstation service address space. (CVE-2009-1544)

  Microsoft has released a security update that addresses this vulnerability by correcting the manner in which the Workstation service allocates and frees memory.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB971657)
  

  Consequence

  An attacker who successfully exploited this vulnerability could run arbitrary code with elevated privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 2 and Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS09-041 for further details.

  Workaround:
  - TCP ports 139 and 445 should be blocked at the firewall to protect systems behind the firewall from attempts to exploit this vulnerability.

  Impact of workaround: Blocking the ports can cause several windows services or applications using those ports to stop functioning.

• Microsoft Windows Message Queuing Elevation of Privilege Vulnerability (MS09-040)

  Severity

  Urgent 5

  Qualys ID

  90518

  Vendor Reference

  MS09-040

  CVE Reference

  CVE-2009-1922

  CVSS Scores

  Base 6.9 / Temporal 5.4

  Description

  Microsoft Message Queuing technology enables applications that are running at different times to communicate across heterogeneous networks and across systems that may be temporarily offline.

  An elevation of privilege vulnerability exists in the Windows Message Queuing service (MSMQ) due to a specific flaw in the parsing of an IOCTL request to the Message Queuing service. The MSMQ service improperly checks input data before passing them to the buffer. An attacker could exploit this vulnerability by sending a specially crafted IOCTL request to the MSMQ service. (CVE-2009-1922)

  Microsoft has released a security update that addresses this vulnerability by modifying the way that the MSMQ service validates input data before passing the data to the allocated buffer.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB971032)
  

  Consequence

  An attacker who successfully exploits this vulnerability could execute arbitrary code and take complete control of an affected system under the LOCAL SYSTEM context. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4

  Windows XP Service Pack 2

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista

  Windows Vista x64 Edition

  Refer to Microsoft Security Bulletin MS09-040 for further details.

  Workaround:
  - Disable the Message Queuing Service. Steps on disabling the service via the Interactive Method are listed below:

  1) Click Start, and then click Control Panel. Alternatively, point to Settings, and then click Control Panel.
  2) Double-click Administrative Tools. Alternatively, click Switch to Classic View and then double-click Administrative Tools.
  3) Double-click Services.
  4) Double-click Message Queuing.
  5) In the Startup type list, click Disabled.
  6) Click Stop, and then click OK.

  - This service can also be disabled via Group Policy settings.

  - The MSMQ service can also be disabled by using the following command at the command prompt (available in Windows XP and in the Microsoft Windows 2000 Resource Kit):

  Sc stop MSMQ & sc config MSMQ start= disabled
  

  Additional instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-040.

• Microsoft Windows Media File Processing Remote Code Execution Vulnerability (MS09-038)

  Severity

  Urgent 5

  Qualys ID

  90517

  Vendor Reference

  MS09-038

  CVE Reference

  CVE-2009-1545, CVE-2009-1546

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Audio Video Interleave (AVI) is a special case of Resource Interchange File Format (RIFF). The .avi file format is a common container format for audio and video data on a computer.

  Windows Media file processing is prone to the following vulnerabilities:

  - The Windows component responsible for processing AVI files does not properly handle specially crafted AVI files with malformed headers. (CVE-2009-1545)

  - A remote code execution vulnerability exists in the way Microsoft Windows handles specially crafted AVI format files. (CVE-2009-1546)

  An attacker can exploit these vulnerabilities by enticing an unsuspecting user into opening a specially crafted AVI file or visit a malicious Web site that contains specially crafted streaming content.

  Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which AVI headers are processed and correcting the manner in which AVI data is validated.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB971557)
  

  Consequence

  If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4

  Windows XP Service Pack 2 and Windows XP Service Pack 3

  Windows XP Professional x64 Edition Service Pack 2

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2

  Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2

  Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2

  Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2

  Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2

  Refer to Microsoft Security Bulletin MS09-038 for further details.

  Workarounds:
  1) Deny access to Avifil32.dll.

  On Windows 2000, Windows XP, and Windows Server 2003 systems, run the following command:
  For 32bit Windows: cacls %windir%\system32\avifil32.dll /E /P everyone:N
  For 64bit Windows:cacls %windir%\syswow64\avifil32.dll /E /P everyone

  On Windows Vista and Windows Server 2008, run the following commands:
  For 32bit Windows:
  takeown.exe /f %windir%\system32\avifil32.dll
  icacls.exe %windir%\system32\avifil32.dll /save %TEMP%\AVIFIL32_ACL.TXT
  icacls.exe %windir%\system32\avifil32.dll /deny everyone:(F)

  For 64bit Windows:
  takeown /f %windir%\syswow64\avifil32.dll
  icacls %windir%\syswow64\avifil32.dll /save %TEMP%\AVIFIL32_ACL.TXT
  icacls %windir%\syswow64\avifil32.dll /deny everyone:(F)

  Impact of workaround #1: Applications that rely on the AVIFile API will fail to render AVI video content properly.

  2) Remove HKEY_CLASSES_ROOT\CLSID\(40C3D757-D6E4-4b49-BB41-0E5BBEA28817) to prevent Windows Explorer from previewing AVI files. This can be done via the Interactive Method or by using a Managed Deployment Script. Note:This workaround is only applicable for CVE-2009-1545.

  Impact of workaround #2: Windows Explorer will not provide a preview image for AVI files.

  For detailed instructions on applying the workarounds, please refer to Microsoft Security Bulletin MS09-038.

• Microsoft WINS Remote Code Execution Vulnerabilities (MS09-039)

  Severity

  Critical 4

  Qualys ID

  90516

  Vendor Reference

  MS09-039

  CVE Reference

  CVE-2009-1923, CVE-2009-1924

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Windows Internet Name Service (WINS) is a protocol designed specifically to support NetBIOS over TCP/IP (NetBT).

  - A remote code execution vulnerability exists in the Windows Internet Name Service (WINS) due to a buffer overflow caused by incorrect calculation of buffer length when processing specially crafted WINS network packets. An attacker could exploit this vulnerability by sending a specially crafted WINS replication packet to an affected system running the WINS service. (CVE-2009-1923)

  - A remote code execution vulnerability exists in the default configuration of the Windows Internet Name Service (WINS) due to insufficient validation of data structures within specially crafted WINS network packets received from a trusted WINS replication partner. (CVE-2009-1924)

  Microsoft has released a security update that addresses these vulnerabilities by correcting the manner in which the WINS service calculates buffer length and introducing proper data validations on received packets on the WINS server.

  Consequence

  Successful exploitation of this vulnerability allows remote code execution. An attacker could gain complete control over the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Server Service Pack 4

  Windows Server 2003 Service Pack 2

  Windows Server 2003 x64 Edition Service Pack 2

  Windows Server 2003 with SP2 for Itanium-based Systems

  Refer to Microsoft Security Bulletin MS09-039 for further details.

  Workaround:
  - Block TCP port 42 and UDP port 42 at the firewall to prevent systems that are behind that firewall from being attacked by attempts to exploit this vulnerability.

  Impact of workaround: Blocking the ports can cause several windows services or applications using those ports to stop functioning.

• Microsoft Active Template Library (ATL) Remote Code Execution Vulnerability (MS09-037)

  Severity

  Urgent 5

  Qualys ID

  90515

  Vendor Reference

  MS09-037

  CVE Reference

  CVE-2008-0015, CVE-2008-0020, CVE-2009-0901, CVE-2009-2493, CVE-2009-2494

  CVSS Scores

  Base 10 / Temporal 8.7

  Description

  Microsoft Active Template Library is prone to the following vulnerabilities:

  - The function CComVariant::ReadFromStream used in the ATL header does not properly restrict untrusted data read from a stream. This issue could lead to reading data directly onto the stack instead of reading it into the area of memory allocated for an array. (CVE-2008-0015)

  - A remote code execution vulnerability is caused by an error in the Load method of the IPersistStreamInit interface. The Load method could allow calls to "memcopy" with untrusted data. (CVE-2008-0020)

  - A remote code execution vulnerability exists in the Microsoft Active Template Library (ATL) due to an issue in the ATL headers that could allow an attacker to force VariantClear to be called on a VARIANT that has not been correctly initialized. (CVE-2009-0901)

  - A vulnerability exists due to issues in the ATL headers that handle instantiation of an object from data streams. For components and controls built using ATL, unsafe usage of OleLoadFromStream could allow the instantiation of arbitrary objects which can bypass certain related security policies. (CVE-2009-2493)

  - A remote code execution vulnerability exists due to a bug in the ATL header that could allow reading a variant from a stream and leaving the variant type read with an invalid variant. When deleting the variant, it would be possible to free unintended areas in memory that could be controlled by an attacker, resulting in inconsistent memory contents and execution of malicious code. (CVE-2009-2494)

  Microsoft has released a security update that resolves these vulnerabilities in Microsoft Active Template Library (ATL) by modifying the ATL headers so that components and controls built using the headers can safely initialize from a data stream, and by providing updated versions of Windows components and controls built using corrected ATL headers.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  Aug 09 Security Updates for Standard 09 and XPe are Now Available (KB973908, 973354, 973507, 973540, 973815, 973869)
  

  Consequence

  The vulnerabilities could allow remote code execution if a user loaded a specially crafted component or control hosted on a malicious Web site. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 5.5 Service Pack 2)

  Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 6 Service Pack 1)

  Microsoft Windows 2000 Service Pack 4 (Windows Media Player 9)

  Microsoft Windows 2000 Service Pack 4 (Windows ATL Component)

  Microsoft Windows 2000 Service Pack 4 (DHTML Editing Component ActiveX Control)

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Outlook Express 6)

  Windows XP Service Pack 2 (Windows Media Player 9, Windows Media Player 10, and Windows Media Player 11)

  Windows XP Service Pack 3 (Windows Media Player 9)

  Windows XP Service Pack 3 (Windows Media Player 10, and Windows Media Player 11)

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows ATL Component)

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (DHTML Editing Component ActiveX Control)

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft MSWebDVD ActiveX Control)

  Windows XP Professional x64 Edition Service Pack 2 (Microsoft Outlook Express 6)

  Windows XP Professional x64 Edition Service Pack 2 (Windows Media Player 10)

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS09-037.

  Workaround:
  - Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.
  - Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

  Impact of the Workaround:
  On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

  Additional details on the workaround can be found at Microsoft Security Advisory (973882).

• Microsoft Office Web Components Remote Code Execution Vulnerability (MS09-043)

  Severity

  Urgent 5

  Qualys ID

  110101

  Vendor Reference

  KB973472, MS09-043

  CVE Reference

  CVE-2009-0562, CVE-2009-1136, CVE-2009-1534, CVE-2009-2496

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft Office Web Components are a collection of Component Object Model (COM) controls for publishing spreadsheets, charts, and databases to the Web, and for viewing the published components on the Web.

  - Office Web Components are prone to multiple remote code execution vulnerabilities that are caused when the ActiveX control is used in Internet Explorer. An attacker could exploit the vulnerability by constructing a specially crafted Web page. The control may corrupt the system state in such a way that an attacker could run arbitrary code. (CVE-2009-1136, CVE-2009-0562, CVE-2009-2496, CVE-2009-1534)

  Microsoft has released a security update that addresses these vulnerabilities by correctly handling memory allocation when the ActiveX control is used in Internet Explorer, correcting validation logic for Office Web Components ActiveX control methods, and performing additional parameter validation.

  Previously, Microsoft had released Microsoft Security Advisory (973472) for this vulnerability.
  Note: This vulnerability is applicable to versions of the software that are not listed in the official advisory.For details see: http://www.qualys.com/research/exploits/#MS09-043

  Consequence

  Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the user running the application. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office XP Service Pack 3

  Microsoft Office 2003 Service Pack 3

  Microsoft Office 2000 Web Components Service Pack 3

  Microsoft Office XP Web Components Service Pack 3

  Microsoft Office 2003 Web Components Service Pack 3

  Microsoft Office 2003 Web Components Service Pack 1 for the 2007 Microsoft Office System

  Microsoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3

  Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3

  Microsoft Internet Security and Acceleration Server 2006 Standard Edition Service Pack 1

  Microsoft Internet Security and Acceleration Server 2006 Enterprise Edition Service Pack 1

  Microsoft BizTalk Server 2002

  Microsoft Visual Studio .NET 2003 Service Pack 1

  Microsoft Office Small Business Accounting 2006

  Refer to Microsoft Security Bulletin MS09-043 for further details.

  Workarounds:
  1) Prevent Office Web Components Library from running in Internet Explorer by setting the kill bit for the control in the registry. Refer to Microsoft article KB240797 for information on setting the kill bits.

  Impact of workaround #1: Disabling the Office Web Component prevents Internet Explorer from instantiating the control. This configuration causes program compatibility issues when Office Web Components functionality is required.

  2) Unregister the Office Web Components Library.

  Impact of workaround #2: Applications requiring Office Web Components functionality will not function.

  3) Restrict Web sites to only your trusted Web sites.

  4) Set Internet and Local Intranet security zone settings to "High" to prompt before running ActiveX controls in these zones.

  Detailed instructions on applying the workarounds can be found at Microsoft Security Bulletin MS09-043.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.