Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 15 vulnerabilities that were fixed in 5 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 5 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Internet Explorer Cumulative Security Update Missing (MS06-013)

  Severity

  Urgent 5

  Qualys ID

  100034

  Vendor Reference

  MS06-013

  CVE Reference

  CVE-2006-1185, CVE-2006-1186, CVE-2006-1188, CVE-2006-1189, CVE-2006-1190, CVE-2006-1191, CVE-2006-1192, CVE-2006-1245, CVE-2006-1359, CVE-2006-1388

  CVSS Scores

  Base 10 / Temporal 8.7

  Description

  Multiple vulnerabilities have been found in Internet Explorer that can be exploited by visiting malicious Web sites, including:

  - DHTML Method Call Memory Corruption Vulnerability
  - Multiple Event Handler Memory Corruption Vulnerability
  - HTA Execution Vulnerability
  - HTML Parsing Vulnerability
  - COM Object Instantiation Memory Corruption Vulnerability
  - HTML Tag Memory Corruption Vulnerability
  - Double-Byte Character Parsing Memory Corruption Vulnerability
  - Script Execution Vulnerability
  - Cross-Domain Information Disclosure Vulnerability
  - Address Bar Spoofing Vulnerability

  Details of individual vulnerabilities may be found in the referenced advisory.

  Consequence

  If a user is logged on with administrative user rights, an attacker who successfully exploits the most severe of these vulnerabilities could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; and create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=594E7B87-AF8F-4346-9164-596E3E5C22B1

  Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 or on Microsoft Windows XP Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=033C41E1-2B36-4696-987A-099FC57E0129

  Internet Explorer 6 for Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F05FFB31-E6B4-4771-81F1-4ACCEBF72133

  Internet Explorer 6 for Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EE566871-D217-41D3-BECC-B27FAFA00054

  Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E584957C-0ABE-4129-ABAF-AA2852AD62A3

  Internet Explorer 6 for Microsoft Windows Server 2003 x64 Edition :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5A1C8BE3-39EE-4937-9BD1-280FC35125C6

  Internet Explorer 6 for Microsoft Windows XP Professional x64 Edition :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C278FE3E-620A-4BBC-868B-CA2D9EFF7AC3

  Refer to Micrsoft Security Bulletin MS06-013 for further details.

• Microsoft Data Access Components (MDAC) Function Could Allow Code Execution (MS06-014)

  Severity

  Serious 3

  Qualys ID

  90306

  Vendor Reference

  MS06-014

  CVE Reference

  CVE-2006-0003

  CVSS Scores

  Base 5.1 / Temporal 4.4

  Description

  A remote code execution vulnerability exists in the RDS.Dataspace ActiveX control that is provided as part of the ActiveX Data Objects (ADO) and that is distributed in Microsoft Data Access Components (MDAC). An attacker who successfully exploits this vulnerability could take complete control of an affected system.

  Consequence

  If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of the affected system. The attacker could then install programs; view, change, or delete data; and create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows XP Service Pack 1 running Microsoft Data Access Components 2.7 Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2F9E772C-8122-4027-A117-E93227B2C79F

  Microsoft Windows XP Service Pack 2 running Microsoft Data Access Components 2.8 Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2F9E772C-8122-4027-A117-E93227B2C79F

  Microsoft Windows XP Professional x64 Edition running Microsoft Data Access Components 2.8 Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9C8B645D-0F01-4B79-B6B3-55279BEDB944

  Microsoft Windows Server 2003 running Microsoft Data Access Components 2.8 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=39B29ED4-9B95-4593-BCB6-4BB03CA5F8F1

  Microsoft Windows Server 2003 Service Pack 1 running Microsoft Data Access Components 2.8 Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=39B29ED4-9B95-4593-BCB6-4BB03CA5F8F1

  Microsoft Windows Server 2003 for Itanium based Systems running Microsoft Data Access Components 2.8 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4D2FE426-E34E-4192-8A0F-35E440E948E2

  Microsoft Windows Server 2003 with SP1 for Itanium based Systems running Microsoft Data Access Components 2.8 Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4D2FE426-E34E-4192-8A0F-35E440E948E2

  Microsoft Windows Server 2003 x64 Edition running Microsoft Data Access Components 2.8 Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E237C2C7-9819-437B-AB70-298BA62AC285

  Windows 2000 Service Pack 4 with Microsoft Data Access Components 2.5 Service Pack 3 installed :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=1B3E6CB9-1EF2-4BA1-A2F2-F87B717372FB

  Windows 2000 Service Pack 4 with Microsoft Data Access Components 2.7 Service Pack 1 installed :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=0AA7C8B7-8417-42D8-8E73-5466C03B8C65

  For a complete list of patch download links, please refer to Microsoft Security Bulletin MS06-014.

• Microsoft Windows Explorer Remote Code Execution Vulnerability (MS06-015)

  Severity

  Urgent 5

  Qualys ID

  90305

  Vendor Reference

  MS06-015

  CVE Reference

  CVE-2004-2289, CVE-2006-0012

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  A remote code execution vulnerability exists in Windows Explorer because of the way that it handles COM objects. To exploit this vulnerability, an attacker would need to convince a user to visit a Web site that could force a connection to a remote file server. This remote file server could then cause Windows Explorer to fail in a way that would allow code execution. An attacker who successfully exploits this vulnerability could take complete control of an affected system.

  Consequence

  If successfully exploited, a remote attacker could take complete control of the affected system. The attacker could then install programs; view, change, or delete data; and create new accounts with full user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=AE28BC65-3A5E-4497-AD05-2CDE8E7B5E95

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=392C2F1B-AA24-48E5-8D5B-EA56341DB936

  Microsoft Windows XP Professional x64 Edition :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=11A5195E-3F32-41F9-AB39-68A099EE945D

  Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=099EE535-8B31-4356-B3FB-EF524C20A424

  Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E3C7E736-1583-4BD5-B661-A9AADDFA5B86

  Microsoft Windows Server 2003 x64 Edition :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=238AB809-5A7E-4678-B01B-38FD82E9C701

  Refer to Microsoft Security Bulletin MS06-015 for further details.

• Microsoft Outlook Express Cumulative Security Update Missing (MS06-016)

  Severity

  Critical 4

  Qualys ID

  90307

  Vendor Reference

  MS06-016

  CVE Reference

  CVE-2006-0014

  CVSS Scores

  Base 5.1 / Temporal 3.8

  Description

  A remote code execution vulnerability exists in Outlook Express when using a Windows Address Book (.wab) file. Microsoft has rated this update as important.

  Consequence

  If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of the affected system. The attacker could then install programs; view, change, or delete data; and create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Outlook Express 6 on Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=484DE679-5505-4196-BDD8-F7CF325AF0F5

  Outlook Express 6 on Microsoft Windows Server 2003 x64 Edition :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A7B10D8F-D9D7-4423-AA6D-C1C41D23794E

  Outlook Express 6 Microsoft Windows Server 2003 on Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?familyid=800BF687-BEE5-478F-A025-43CD16682F31

  Outlook Express 6 on Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=0DD827BC-6FA1-405A-933E-FB422A4E8096

  Outlook Express 6 on Microsoft Windows XP Professional x64 Edition :
  http://www.microsoft.com/downloads/details.aspx?familyid=FF772C0B-6F98-449D-B02E-C9C236068172

  Outlook Express 6 Service Pack 1 on Microsoft Windows XP Service Pack 1 or when installed on Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=CDA93501-99CB-4F28-BB73-6438CAD081DB

  Outlook Express 5.5 Service Pack 2 on Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E61A3D64-14FD-4976-BB03-C31CA6EE61E2

  Refer to Microsoft Security Bulletin MS06-016 for further details.

• FrontPage Server Extensions Cross-Site Scripting Vulnerability (MS06-017)

  Severity

  Serious 3

  Qualys ID

  86739

  Vendor Reference

  MS06-017

  CVE Reference

  CVE-2006-0015

  CVSS Scores

  Base 6.8 / Temporal 5.3

  Description

  FrontPage Server Extensions is a set of tools that can be installed on a Web site. The tools allow authorized personnel to manage the server, add or change content, and perform other tasks.

  A cross-site scripting vulnerability exists that could allow an attacker to convince a user to run a malicious client-side script on behalf of a FrontPage Server Extensions user.

  QID Detection Logic (Authenticated):
  Operating System: Windows
  The QID checks the version of the file "fpadmdll.dll" (for FrontPage Server Extension 2002).

  QID Detection Logic (Unauthenticated):
  The QID sends a GET /_vti_inf.html request to retrieve the version of FrontPage Server Extension running on the Host.

  Consequence

  An attacker who successfully exploits this vulnerability could gain the same rights as the user's rights on the FrontPage Server Extensions 2002 or SharePoint Team Services 2002 server.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft FrontPage Server Extensions 2002 shipped on Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=5C03F85A-5228-47FB-A338-90FA23818E08

  Microsoft FrontPage Server Extensions 2002 shipped on Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows Server 2003 with SP1 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyID=59f15a6b-cc1b-43d5-a007-bfc9abb63486

  Microsoft FrontPage Server Extensions 2002 (x64 Edition) downloaded and installed on Microsoft Windows Server 2003 x64 Edition and Microsoft Windows XP Professional x64 Edition :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F453530D-7063-49AB-B304-9C455DE6D8DA

  Microsoft FrontPage Server Extensions 2002 (x86 Editions) downloaded and installed on Microsoft Windows Server 2000 Service Pack 4, Microsoft Windows XP Service Pack 1, and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F453530D-7063-49AB-B304-9C455DE6D8DA

  Microsoft SharePoint Team Services :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EEE40662-39E6-4C07-8241-1AC4F5D24FFC

  Refer to Microsoft Security Bulletin MS06-017 for further details.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.