Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 12 vulnerabilities that were fixed in 6 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 6 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Excel Could Allow Remote Code Execution Vulnerabilities (MS07-036)

  Severity

  Urgent 5

  Qualys ID

  110062

  Vendor Reference

  MS07-036

  CVE Reference

  CVE-2007-1756, CVE-2007-3029, CVE-2007-3030

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  Microsoft Excel is prone to multiple remote code execution vulnerabilities due to insufficiant handeling of malformed Excel Files.

  MS07-036 addresses the following issues.
  - Excel does not perform sufficient validation when denoting the start of a Workspace designation.
  - Excel does not perform sufficient data validation in processing the number of active worksheets, which can result in memory corruption.
  - Excel does not correctly validate version information, which can result in memory corruption.

  Consequence

  An attacker who successfully exploits this vulnerability could run arbitrary code on the affected system as the logged on user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office 2000 Service Pack 3 (Microsoft Excel 2000 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=83D94D8E-DDA6-4D74-B40D-476C2F0A3AF4

  Microsoft Office XP Service Pack 3 (Microsoft Excel 2002 Service Pack 3):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5E09D13B-D4B0-48FD-9880-73C180570267

  Microsoft Office 2003 Service Pack 2 (Microsoft Excel 2003 Service Pack 2):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9D93C0CE-5124-4234-BA84-3C27005E010F

  Microsoft Office 2003 Service Pack 2 (Microsoft Excel 2003 Viewer):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=11F42977-8828-494A-A183-D1ABA827B708

  Microsoft Office 2004 for Mac (Microsoft Office 2004 for Mac):
  http://www.microsoft.com/mac/downloads.aspx?pid=download&location=/mac/download/Office2004/Office2004_1136.xml&secid=4&ssid=35&flgnosysreq=True

  2007 Microsoft Office System (Microsoft Office Excel 2007):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9AB28283-0320-4527-B033-5E80EF32CD34

  Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E592AE5B-09AC-4F5B-B457-A54C9850AD4A

  Refer to Micrsoft Security Bulletin MS07-036 for further details.

• Microsoft Office Publisher 2007 Could Allow Remote Code Execution (MS07-037)

  Severity

  Critical 4

  Qualys ID

  110056

  Vendor Reference

  MS07-037

  CVE Reference

  CVE-2007-1754

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  Microsoft Office Publisher is a desktop publishing application.
  
  A remote code execution vulnerability exists in the way Publisher does not adequately clear out memory resources when writing application data from disk to memory. An attacker could exploit the vulnerability by constructing a specially crafted Publisher (.pub) page.
  
  Previously this was a Zero Day.

  Consequence

  If the vulnerability is successfully exploited, this could result in the execution of arbitrary code in the context of the currently logged in user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  2007 Microsoft Office System (Microsoft Office Publisher 2007):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=25D272E7-F2DD-4342-92BE-7EBC2E770B44

  Refer to Micrsoft Security Bulletin MS07-037 for further details.

• Windows Vista Firewall Could Allow Information Disclosure (MS07-038)

  Severity

  Serious 3

  Qualys ID

  90402

  Vendor Reference

  MS07-038

  CVE Reference

  CVE-2007-3038

  CVSS Scores

  Base 7.8 / Temporal 5.8

  Description

  There is an information disclosure vulnerability in Windows Vista that could allow a remote anonymous attacker to send inbound network traffic to the affected system.

  It would be possible for the attacker to gain information about the system over the network.

  Consequence

  An attacker who successfully exploits this vulnerability could bypass some of the firewall rules of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows Vista:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=e9b64746-6afa-4a30-833d-e058e000c821

  Windows Vista x64 Edition:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=0df5d190-3ad7-42d5-8629-43c47ec450cb

  Refer to Microsoft Security Bulletin MS07-038 for further details.

• Windows Active Directory Multiple Remote Code Execution Vulnerabilities (MS07-039)

  Severity

  Urgent 5

  Qualys ID

  90403

  Vendor Reference

  MS07-039

  CVE Reference

  CVE-2007-0040, CVE-2007-3028

  CVSS Scores

  Base 10 / Temporal 7.4

  Description

  Microsoft Security Advisory MS07-039 addresses the following issues with Active Directory on Windows 2003 and 2000 Server:

  • A remote code execution vulnerability exists in the way that Active Directory validates a LDAP request.
  • A denial of service vulnerability exists in the way that Microsoft Active Directory validates a client-sent LDAP request.

  Consequence

  An attacker who successfully exploited this vulnerability could take complete control of an affected system or cause the server to stop responding.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Server Service Pack 4:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=812e62c5-6e19-4b3b-8a10-861b871e1b41

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=28e84603-8159-4429-aaff-a1020531e84f

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=107902f9-be94-457f-a936-519efbd64779

  Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=e5e5b425-fe7d-49d5-973f-f3fd7a1e04eb

  Refer to Micrsoft Security Bulletin MS07-039 for further details.

• Microsoft .NET Framework Remote Code Execution Vulnerabilities (MS07-040)

  Severity

  Critical 4

  Qualys ID

  90401

  Vendor Reference

  MS07-040

  CVE Reference

  CVE-2006-7192, CVE-2007-0041, CVE-2007-0042, CVE-2007-0043

  CVSS Scores

  Base 9.3 / Temporal 7.7

  Description

  This update addresses two vulnerabilities affecting the client systems with .NET Framework installed and one vulnerability affecting web servers running ASP.NET.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  July 2007 Supplemental Updates (for Desktop Installer Tool) are available (KB931212)
  

  Note: If no authentication credentials were supplied during the scan, and this vulnerability is reported as a potential threat; please re-run the scan using authentication credentials to confirm if the vulnerability exists on the target.
  
  To manually verify the patch has been applied without running an authenticated scan, refer to the "Security Update Deployment" section of the MS07-04 Bulletin. The bulletin contains updated file version and registry key information.

  Consequence

  The successful exploitation of these vulnerabilities could lead to remote code execution and information disclosure.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows 2000 Service Pack 4 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows XP Service Pack 2 and Windows XP Service Pack 3 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows XP Tablet PC Edition 2005 and Windows XP Media Center Edition 2005 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=829A2C5B-11EC-4ED7-91AB-6961034147BC

  Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack 2 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows Server 2003 with SP1 for Itanium-based Systems and Windows Server 2003 with SP2 for Itanium-based Systems (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition Service Pack 2 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows Vista and Windows Vista Service Pack 1 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows Server 2008 (Microsoft .NET Framework 1.0 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=91D7AFE4-069B-4CE8-976E-9A01345A8603

  Windows 2000 Service Pack 4 (Microsoft .NET Framework 1.1 ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=281FB2CD-C715-4F05-A01F-0455D2D9EBFB

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS07-040.

• Microsoft Internet Information Services Could Allow Remote Code Execution (MS07-041)

  Severity

  Serious 3

  Qualys ID

  90400

  Vendor Reference

  MS07-041

  CVE Reference

  CVE-2005-4360

  CVSS Scores

  Base 7.8 / Temporal 6.1

  Description

  This vulnerability exists in IIS Version 5.1 on Windows XP Professional Service Pack 2. An attacker can cause remote code execution by sending specially crafted URL to a Web page hosted by IIS 5.1.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  August 2007 Monthly Security Updates are Now Available on the ECE (KB939373)
  July 2007 Supplemental Updates (for Desktop Installer Tool) are available (KB939373)
  

  Consequence

  An attacker who exploits this vulnerability can take complete control of the system. This update involves all supported 32 bit versions of XP Professional Service Pack 2.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Windows XP Professional Service Pack 2 (Microsoft Internet Information Services ):
  http://www.microsoft.com/downloads/details.aspx?FamilyId=fccbfe90-f838-47df-8310-352e2fb47132

  Refer to Micrsoft Security Bulletin MS07-041 for further details.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.