Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 26 vulnerabilities that were fixed in 11 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 11 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Access Snapshot Viewer ActiveX Control Vulnerability (MS08-041)

  Severity

  Urgent 5

  Qualys ID

  110081

  Vendor Reference

  MS08-041

  CVE Reference

  CVE-2008-2463

  CVSS Scores

  Base 6.8 / Temporal 5.9

  Description

  This security update resolves a privately reported vulnerability in the ActiveX control for the Snapshot Viewer for Microsoft Access. This issue is caused by a design error in the "snapview.ocx" ActiveX control that does not restrict access to certain methods and allows files to be automatically downloaded to arbitrary locations on a user's system.

  Affected products:
  Snapshot Viewer for Microsoft Access
  Microsoft Office Access 2000
  Microsoft Office Access 2002
  Microsoft Office Access 2003

  Consequence

  An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.

  Note: The vulnerability is currently being actively exploited.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Snapshot Viewer for Microsoft Access:
  http://www.microsoft.com/download/details.aspx?FamilyId=7C22BB32-7CE3-4FF2-8366-BA2EB5135833

  Microsoft Office 2000 Service Pack 3 (Microsoft Office Access 2000 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?familyid=54e4031d-298f-480c-88d5-0ad3b2b62ba9

  Microsoft Office XP Service Pack 3 (Microsoft Office Access 2002 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?familyid=34b655f8-1922-4246-94ca-ed381c3e3b13

  Microsoft Office 2003 Service Pack 2 and Microsoft Office 2003 Service Pack 3 (Microsoft Office Access 2003 Service Pack 2 and Microsoft Office Access 2003 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?familyid=fd698517-a504-427d-9e5f-fde8f102142c

  Refer to Micrsoft Security Bulletin MS08-041 for further details.

• Microsoft Word Could Allow Remote Code Execution (MS08-042)

  Severity

  Critical 4

  Qualys ID

  110082

  Vendor Reference

  MS08-042

  CVE Reference

  CVE-2008-2244

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Word versions 2002 and 2003 are vulnerable to a remote code execution issue when handling specially crafted Word files with a malformed record value.

  Previously this was a Zero Day.

  Consequence

  If the vulnerability is successfully exploited, this could result in the execution of arbitrary code.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office XP Service Pack 3 (Microsoft Word 2002 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=c7146dfc-e1be-4d13-877b-1d9bcacc4a64

  Microsoft Office 2003 Service Pack 2 (Microsoft Word 2003 Service Pack 2):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=13a37b76-9fec-426f-8176-3c95f934efe0

  Microsoft Office 2003 Service Pack 3 (Microsoft Word 2003 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=13a37b76-9fec-426f-8176-3c95f934efe0

  Refer to Micrsoft Security Bulletin MS08-042 for further details.

• Microsoft Excel Could Allow Remote Code Execution (MS08-043)

  Severity

  Critical 4

  Qualys ID

  110084

  Vendor Reference

  MS08-043

  CVE Reference

  CVE-2008-3003, CVE-2008-3004, CVE-2008-3005, CVE-2008-3006

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft Excel is prone to multiple remote code execution vulnerabilities. The security update addresses the following issues:

  - Excel Credential Caching Vulnerability (CVE-2008-3003)
  - Excel Indexing Validation Vulnerability (CVE-2008-3004)
  - Excel Index Array Vulnerability (CVE-2008-3005)
  - Excel Record Parsing Vulnerability (CVE-2008-3006)
  

  Consequence

  An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2000 Service Pack 3 (Excel 2000 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4bf8688e-e5b9-4e53-a1a1-8cf1acfdb80b

  Microsoft Office XP Service Pack 3 (Excel 2002 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9BBF7550-F5C4-4B9B-BD86-1E7BE6C42EB5

  Microsoft Office 2003 Service Pack 2 (Excel 2003 Service Pack 2):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fc612e9a-bdf3-4952-8ada-0de5a50973f0

  Microsoft Office 2003 Service Pack 3 (Excel 2003 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fc612e9a-bdf3-4952-8ada-0de5a50973f0

  2007 Microsoft Office System (Excel 2007):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2753e8d6-e156-49ef-af2d-4c521c808ffd

  2007 Microsoft Office System Service Pack 1 (Excel 2007 Service Pack 1):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2753e8d6-e156-49ef-af2d-4c521c808ffd

  Microsoft Office Excel Viewer 2003:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d7ed9e75-15f2-4950-98b3-93023ba0f4c1

  Microsoft Office Excel Viewer 2003 Service Pack 3:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=d7ed9e75-15f2-4950-98b3-93023ba0f4c1

  Microsoft Office Excel Viewer:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=b574d906-7f09-49b0-80bf-e84dee8c4583

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=7afdae9b-9c74-4af7-9844-0e54221ea3b9

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=7afdae9b-9c74-4af7-9844-0e54221ea3b9

  Microsoft Office SharePoint Server 2007:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=a7731749-b026-4765-808a-e151b990f0e1

  For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-043.

• Microsoft Office Filters Could Allow Remote Code Execution (MS08-044)

  Severity

  Critical 4

  Qualys ID

  110085

  Vendor Reference

  MS08-044

  CVE Reference

  CVE-2008-3018, CVE-2008-3019, CVE-2008-3020, CVE-2008-3021, CVE-2008-3460

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft Office Filters contain the following vulnerabilities:

  1) A remote code execution vulnerability exists in the way that a Microsoft Office filter handles a malformed graphics image. (CVE-2008-3019)

  2) A remote code execution vulnerability exists in the way that Microsoft Office handles a PICT-format image file. (CVE-2008-3018 and CVE-2008-3021)

  3) A remote code execution vulnerability exists in the way that Microsoft Office handles a BMP format image file. (CVE-2008-3020)

  4) A remote code execution vulnerability exists in the way that Microsoft Office handles a WordPerfect Graphics (WPG) format image file. (CVE-2008-3460)

  Consequence

  An attacker who successfully exploits this vulnerability could take complete control of an affected system. Significant user interaction is required to exploit this vulnerability.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2000 Service Pack 3:
  http://www.microsoft.com/downloads/details.aspx?familyid=3ab323ec-9f92-453c-b7c7-9a95a9efcaea

  Microsoft Office XP Service Pack 3:
  http://www.microsoft.com/downloads/details.aspx?familyid=bf566ce6-23da-45e5-9c2b-c47331d30e79

  Microsoft Office 2003 Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?familyid=e0df2f6e-1102-461d-829f-5f3e2d7eb4b3

  Microsoft Office Project 2002 Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?familyid=bf566ce6-23da-45e5-9c2b-c47331d30e79

  Microsoft Office Converter Pack:
  http://www.microsoft.com/downloads/details.aspx?familyid=199b08c7-6d79-4930-8f0c-31034629c485

  Microsoft Works 8:
  http://www.microsoft.com/downloads/details.aspx?familyid=458985C3-9C6F-4049-81CD-0D0389C81F11

  Refer to Micrsoft Security Bulletin MS08-044 for further details.

• Microsoft Internet Explorer Cumulative Security Update (MS08-045)

  Severity

  Critical 4

  Qualys ID

  100059

  Vendor Reference

  MS08-045

  CVE Reference

  CVE-2008-2254, CVE-2008-2255, CVE-2008-2256, CVE-2008-2257, CVE-2008-2258, CVE-2008-2259

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  This critical security update resolves vulnerabilities existing in Microsoft Internet Explorer which are present due to HTML objects memory corruption, uninitialized memory corruption and HTML component handling.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2008 Updates are Available (including for XPe SP3 and Standard) (KB953838)
  August 2008 Security Updates Are Now Available (KB953838)
  

  Consequence

  These vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 (Microsoft Internet Explorer 5.01 Service Pack 4):
  http://www.microsoft.com/downloads/details.aspx?familyid=1557B93B-ECBA-4F42-B89D-DB0EE067D65B

  Microsoft Windows 2000 Service Pack 4 (Microsoft Internet Explorer 6 Service Pack 1):
  http://www.microsoft.com/downloads/details.aspx?familyid=AA780735-5928-4C46-89A4-63A814954796

  Windows XP Service Pack 2 (Microsoft Internet Explorer 6):
  http://www.microsoft.com/downloads/details.aspx?familyid=69AF2F30-138E-4B15-AB8D-4FCE44CC0BC2

  Windows XP Service Pack 3 (Microsoft Internet Explorer 6):
  http://www.microsoft.com/downloads/details.aspx?familyid=69AF2F30-138E-4B15-AB8D-4FCE44CC0BC2

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Microsoft Internet Explorer 6):
  http://www.microsoft.com/downloads/details.aspx?familyid=4780B89E-9735-4D3F-8DEF-34E7337FF604

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Microsoft Internet Explorer 6):
  http://www.microsoft.com/downloads/details.aspx?familyid=0617A5DD-DCE9-4DE0-B0A0-CE38EFE13524

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Microsoft Internet Explorer 6):
  http://www.microsoft.com/downloads/details.aspx?familyid=32A63F52-9FE6-48E3-BB4E-7D4DDA5E0A90

  Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft Internet Explorer 6):
  http://www.microsoft.com/downloads/details.aspx?familyid=1855997E-A3BE-46B1-A0BC-BB55EB0045FE

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows Internet Explorer 7):
  http://www.microsoft.com/downloads/details.aspx?familyid=8E2125C7-52CB-4052-82A3-2D3C6A953752

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Windows Internet Explorer 7):
  http://www.microsoft.com/downloads/details.aspx?familyid=39B41E4B-3237-409D-A818-AB0517C5E7CF

  For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-045.

• Microsoft Windows Image Color Management System Could Allow Remote Code Execution (MS08-046)

  Severity

  Critical 4

  Qualys ID

  90450

  Vendor Reference

  MS08-046

  CVE Reference

  CVE-2008-2245

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  This update resolves a privately reported vulnerability in the Microsoft Image Color Management (ICM) system that could allow remote code execution in the context of the current user.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2008 Updates are Available (including for XPe SP3 and Standard) (KB952954)
  August 2008 Security Updates Are Now Available (KB952954)
  

  Consequence

  If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4:
  http://www.microsoft.com/downloads/details.aspx?familyid=db455d17-435f-46d7-b2dd-5babb5a1eeb3

  Windows XP Service Pack 2 and Windows XP Service Pack 3:
  http://www.microsoft.com/downloads/details.aspx?familyid=d313f42c-f43f-48ea-82ef-3bc33077c7fa

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?familyid=3150c6b8-f50b-4b84-a7ce-c8daf77c080c

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?familyid=828d8fdc-8534-4621-85a5-08aec255496f

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?familyid=0a13776f-d543-41df-b904-d51e368c81cc

  Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems:
  http://www.microsoft.com/downloads/details.aspx?familyid=9566493f-4260-4072-947a-527887d2cd63

  Refer to Micrsoft Security Bulletin MS08-046 for further details.

• Microsoft IPsec Policy Processing Information Disclosure Vulnerability (MS08-047)

  Severity

  Serious 3

  Qualys ID

  90447

  Vendor Reference

  MS08-047

  CVE Reference

  CVE-2008-2246

  CVSS Scores

  Base 7.8 / Temporal 6.1

  Description

  This security update resolves a vulnerability in the way certain Windows Internet Protocol Security (IPsec) rules are applied.

  Consequence

  An attacker who successfully exploits these vulnerabilities could cause systems to ignore IPsec policies and transmit network traffic in clear text, disclosing information intended to be encrypted on the network. An attacker viewing the traffic on the network would be able to view and possibly modify the contents of the traffic. Note that this vulnerability would not allow an attacker to execute code or to elevate their user rights directly. It could be used to collect useful information to try to further compromise the affected system(s) or network(s).

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista and Windows Vista Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?familyid=3f21a8a2-9861-4fef-9d1e-caf5f7822c1a

  Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?familyid=aa04a754-fbfb-42a7-89d2-14373e3f4742

  Windows Server 2008 for 32-bit Systems:
  http://www.microsoft.com/downloads/details.aspx?familyid=c3363df6-39dc-4910-9ce5-66553155378e

  Windows Server 2008 for x64-based Systems:
  http://www.microsoft.com/downloads/details.aspx?familyid=39dd1722-412b-469d-a475-b6513764838c

  Windows Server 2008 for Itanium-based Systems:
  http://www.microsoft.com/downloads/details.aspx?familyid=e9c6cd46-30ad-46ee-9c8b-d0b446e660c4

  Refer to Micrsoft Security Bulletin MS08-047 for further details.

• Microsoft Outlook Express and Windows Mail Security Update (MS08-048)

  Severity

  Serious 3

  Qualys ID

  90451

  Vendor Reference

  MS08-048

  CVE Reference

  CVE-2008-1448

  CVSS Scores

  Base 7.1 / Temporal 5.3

  Description

  An information disclosure vulnerability exists in Outlook Express and Windows Mail because the MHTML protocol handler incorrectly interprets MHTML URL redirections that could potentially bypass Internet Explorer domain restrictions when returning MHTML content.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2008 Updates are Available (including for XPe SP3 and Standard) (KB951066)
  August 2008 Security Updates Are Now Available (KB951066)
  

  Consequence

  An attacker who successfully exploits this vulnerability could read data from another Internet Explorer domain or the local computer.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 5.5 Service Pack 2):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6257bfae-35f0-4c0e-b960-bca7aa6f86f7

  Microsoft Windows 2000 Service Pack 4 (Microsoft Outlook Express 6 Service Pack 1):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=dab178f7-c282-41f4-acb1-a86e6aa4c91b

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft Outlook Express 6 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91469f2f-461c-4a67-8738-d42520427f6b

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Microsoft Outlook Express 6 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2220aece-79d2-426f-90ec-24a17470567a

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Microsoft Outlook Express 6):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=30f2244a-f6fd-4fc1-a871-abf6958cb660

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Microsoft Outlook Express 6):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3287f006-cbb2-4c6d-820c-32833e08035a

  Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft Outlook Express 6):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=c8570e40-355b-4a9b-933d-53ae021cbda5

  Windows Vista and Windows Vista Service Pack 1 (Windows Mail):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3851bcf8-f971-4d38-b27f-97396854aac0

  Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1 (Windows Mail):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3bf7eb8a-b347-4661-be2d-682adc713769

  Windows Server 2008 for 32-bit Systems (Windows Mail):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=dc3c4b63-acd3-4469-8d47-e0562d99ee65

  For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-048.

• Microsoft Event System Could Allow Remote Code Execution (MS08-049)

  Severity

  Critical 4

  Qualys ID

  90448

  Vendor Reference

  MS08-049

  CVE Reference

  CVE-2008-1456, CVE-2008-1457

  CVSS Scores

  Base 9 / Temporal 7

  Description

  This update resolves two privately reported vulnerabilities in Microsoft Windows Event System that could allow remote code execution.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2008 Updates are Available (including for XPe SP3 and Standard) (KB950974)
  August 2008 Security Updates Are Now Available (KB950974)
  

  Consequence

  An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=1b2ad648-7dc9-407a-99f6-f39922746027

  Windows XP Service Pack 2 and Windows XP Service Pack 3:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=01a34aa4-a456-4efc-a93a-c3c682b0181c

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?FamilyID=246b2686-e330-47a2-b4d4-68f218ad4021

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?FamilyID=92a3d08f-c117-4b24-bc78-2b913d270df6

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6bfbb6d8-5106-4adf-83cb-35ffc6e8eaf8

  Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems:
  http://www.microsoft.com/downloads/details.aspx?FamilyID=45356565-697f-41b3-9879-3edd11dbcb7e

  Windows Vista and Windows Vista Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?familyid=6418c78f-f008-4028-beb1-5a5ea8e797a1

  Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?familyid=e03ccfb0-3ea3-4c59-adcf-9882d7086013

  Windows Server 2008 for 32-bit Systems:
  http://www.microsoft.com/downloads/details.aspx?familyid=0640f95e-1eee-4dd1-b4dd-2b82b7e984b9

  Windows Server 2008 for x64-based Systems:
  http://www.microsoft.com/downloads/details.aspx?familyid=51a93538-5e94-4f81-a6e0-d497a7b4899d

  Windows Server 2008 for Itanium-based Systems:
  http://www.microsoft.com/downloads/details.aspx?familyid=390da130-749d-4890-aad7-be91e15b32bb

  Refer to Micrsoft Security Bulletin MS08-049 for further details.

• Microsoft Windows Messenger Information Disclosure Vulnerability (MS08-050)

  Severity

  Critical 4

  Qualys ID

  90449

  Vendor Reference

  MS08-050

  CVE Reference

  CVE-2008-0082

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  An information disclosure vulnerability exists in Windows Messenger which occurs due to scripting of a particular ActiveX control (Messenger.UIAutomation.1).

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  December 2008 Updates are Available (including for XPe SP3 and Standard) (KB946648)
  August 2008 Security Updates Are Now Available (KB946648)
  

  Consequence

  An attacker could change state, get contact information and initiate audio and video chat sessions without the knowledge of the logged on user. An attacker could also impersonate the user by capturing the user's logon ID and remotely log on to the user's Messenger client.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows Messenger 4.7):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=8f588f7e-c4ed-42a0-b157-54b1eda60474

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Windows Messenger 4.7):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=a5fc5457-832f-4ee8-be60-4cc8518d1c10

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Windows Messenger 4.7):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=302315a8-ccb2-47c2-9104-b8e1d1f49aa0

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Windows Messenger 4.7):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=be94d138-7d7b-489e-baa6-e214950be6b9

  Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Windows Messenger 4.7):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=e4b72618-536b-4a21-bd91-d91be9ca24e5

  Microsoft Windows 2000 Service Pack 4 (Windows Messenger 5.1):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Windows Messenger 5.1):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Windows Messenger 5.1):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Windows Messenger 5.1):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Windows Messenger 5.1):
  http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774

  For a complete list of patch download links, please refer to Micrsoft Security Bulletin MS08-050.

• Microsoft PowerPoint Could Allow Remote Code Execution (MS08-051)

  Severity

  Urgent 5

  Qualys ID

  110083

  Vendor Reference

  MS08-051

  CVE Reference

  CVE-2008-0120, CVE-2008-0121, CVE-2008-1455

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  Three vulnerabilities exist in Microsoft Office PowerPoint and Microsoft Office PowerPoint Viewer that could allow remote code execution.

  The security update addresses the following issues:

  - Memory Allocation Vulnerability (CVE-2008-0120)
  - Memory Calculation Vulnerability (CVE-2008-0121)
  - Parsing Overflow Vulnerability (CVE-2008-1455)

  Consequence

  An attacker who successfully exploits any of these vulnerabilities could take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2000 Service Pack 3 (Microsoft Office PowerPoint 2000 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=e7c044d8-778a-4985-b25b-4f7f6e4abadd

  Microsoft Office XP Service Pack 3 (Microsoft Office PowerPoint 2002 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=f8921074-7985-4d42-ac2b-d2f3b1d466ba

  Microsoft Office 2003 Service Pack 2 (Microsoft Office PowerPoint 2003 Service Pack 2):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=7a7c21f0-5e0e-4dee-9710-1ce3d565913f

  Microsoft Office 2003 Service Pack 3 (Microsoft Office PowerPoint 2003 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=7a7c21f0-5e0e-4dee-9710-1ce3d565913f

  2007 Microsoft Office System (Microsoft Office PowerPoint 2007):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=55fd618a-e9c5-4f1e-b9a5-b2e47ec98ef1

  2007 Microsoft Office System Service Pack 1 (Microsoft Office PowerPoint 2007 Service Pack 1):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=55fd618a-e9c5-4f1e-b9a5-b2e47ec98ef1

  Microsoft Office PowerPoint Viewer 2003:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=911c8872-dec8-4b8e-9708-93dcabd3e036

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
  http://www.microsoft.com/downloads/details.aspx?familyid=84ce5d58-0010-4945-bce9-67a41f898f2f

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1:
  http://www.microsoft.com/downloads/details.aspx?familyid=84ce5d58-0010-4945-bce9-67a41f898f2f

  Microsoft Office 2004 for Mac:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EBD3AF0C-3F62-4D18-BF45-881655683BD5

  Refer to Micrsoft Security Bulletin MS08-051 for further details.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.