Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 19 vulnerabilities that were fixed in 8 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 8 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Word Vulnerability Could Allow Remote Code Execution (MS05-023)

  Severity

  Urgent 5

  Qualys ID

  110031

  Vendor Reference

  MS05-023

  CVE Reference

  CVE-2004-0963, CVE-2005-0558

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Microsoft Word on the host is missing the patch described in Security Bulletin MS05-023.

  A vulnerability exists in Microsoft Word that could allow an attacker to run arbitrary code on a user's system. If a user is logged on with administrative privileges, an attacker who successfully exploits this vulnerability could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts with full privileges.

  Consequence

  Successful exploitation of this issue can result in arbitrary code execution.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Word 2003 Viewer :
  http://www.microsoft.com/downloads/details.aspx?familyid=95E24C87-8732-48D5-8689-AB826E7B8FDF&displaylang=en

  Microsoft Word 2000 and Microsoft Works Suite 2001 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9F4B6868-2F94-478F-B0BC-0DA3E0571523

  Microsoft Word 2002, Microsoft Works Suite 2002, Microsoft Works Suite 2003, and Microsoft Works Suite 2004 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=34998255-E004-4A29-9418-35C5818E54CB

  Microsoft Office Word 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9158279D-4421-4932-9318-02CA829A9B43

  Refer to Micrsoft Security Bulletin MS05-023 for further details.

• Microsoft Windows Shell Code Execution (MS05-016)

  Severity

  Critical 4

  Qualys ID

  90242

  Vendor Reference

  MS05-016

  CVE Reference

  CVE-2005-0063

  CVSS Scores

  Base 7.5 / Temporal 6.2

  Description

  A remote code execution vulnerability exists in the Windows Shell because of the way that it handles application association.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  April Security Updates for Embedded (KB893086)
  

  Consequence

  If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create acounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A7511A19-ADD5-4793-92AC-25E953CE405C

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=51679BB1-A61B-47AC-A943-F9F306EF987B

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=D513C252-FF70-46E3-BD79-077A336A974D

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=32ADAB00-6ED3-4418-8539-7FA468AD5DBD

  Microsoft Windows Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F803F008-5EE8-4BBE-8136-BC21708D1025

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=32ADAB00-6ED3-4418-8539-7FA468AD5DBD

  Refer to Micrsoft Security Bulletin MS05-016 for further details.

• Microsoft Message Queuing Buffer Overflow (MS05-017)

  Severity

  Urgent 5

  Qualys ID

  90240

  Vendor Reference

  MS05-017

  CVE Reference

  CVE-2005-0059

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  Microsoft Message Queuing (MSMQ) attempts to facilitate process communication over the Internet. It attempts to guarantee message delivery through priority queuing mechanisms.

  A remote code execution vulnerability exists in the Message Queuing service.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  April Security Updates for Embedded (KB892944)
  

  Consequence

  An attacker who successfully exploits this vulnerability could remotely take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=99A8EE12-4BD6-43F5-A43F-124E0E2C2283

  Microsoft Windows XP Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=D72B7198-93A8-4652-B505-8E51FC5EEAC3

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9124BA48-73A8-4C94-AA46-CE9A9D1E1198

  Refer to Micrsoft Security Bulletin MS05-017 for further details.

• Windows Multiple Denial of Service and Privilege Elevation Vulnerabilities (MS05-018)

  Severity

  Urgent 5

  Qualys ID

  90243

  Vendor Reference

  MS05-018

  CVE Reference

  CVE-2005-0060, CVE-2005-0061, CVE-2005-0550, CVE-2005-0551

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  Microsoft has released Security Bulletin MS05-018 to address the multiple denial of service and privilege elevation vulnerabilities.

  Multiple vulnerabilities exist in font processing, CRSS.exe client/server runtime server subsystem, object management and the Windows kernel.

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  April Security Updates for Embedded (KB890859)
  

  Consequence

  An attacker who successfully exploits this vulnerability could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts that have full privileges.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=992C1BF9-A2C0-49D2-9059-A1DAD6703213

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F0683E2B-8E8F-474F-B8D8-46C4C33FCE99

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=B52F9281-570F-4F7A-8DEF-5AEAB6E8E002

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C51D6AD5-93BA-4717-A5DB-5CE78F70592E

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C51D6AD5-93BA-4717-A5DB-5CE78F70592E

  Refer to Micrsoft Security Bulletin MS05-018 for further details.

• Windows TCP/IP Remote Code Execution and Denial of Service Vulnerabilities (MS05-019)

  Severity

  Critical 4

  Qualys ID

  90244

  Vendor Reference

  MS05-019

  CVE Reference

  CVE-2004-0230, CVE-2004-0790, CVE-2004-0791, CVE-2004-1060, CVE-2005-0048, CVE-2005-0688

  CVSS Scores

  Base 7.5 / Temporal 5.9

  Description

  Microsoft Security Update MS05-019 was not found on the host. This update resolves the issues described below.

  IP Validation Vulnerability:
  A remote code execution vulnerability allows an attacker to send a specially crafted IP message to an affected system. An attacker who successfully exploits this vulnerability could cause the affected system to remotely execute code. However, attempts to exploit this vulnerability would most likely result in a denial of service. (CAN-2005-0048)

  ICMP Connection Reset Vulnerability:
  A denial of service vulnerability allows an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system. An attacker who successfully exploits this vulnerability could cause the affected system to reset existing TCP connections. (CAN-2004-0790)

  ICMP Path MTU Vulnerability:
  A denial of service vulnerability allows an attacker to send a specially crafted Internet Control Message Protocol (ICMP) message to an affected system, which could cause network performance to degrade and potentially stop the affected system from responding to requests. (CAN-2004-1060)

  TCP Connection Reset Vulnerability:
  A denial of service vulnerability allows an attacker to send a specially crafted TCP message to an affected system. An attacker who successfully exploits this vulnerability could cause the affected system to reset existing TCP connections. (CAN-2004-0230)

  Spoofed Connection Request Vulnerability:
  A denial of service vulnerability allows an attacker to send a specially crafted TCP/IP message to an affected system. An attacker who successfully exploited this vulnerability could cause the affected system to stop responding. (CAN-2005-0688)

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  June Security Updates for Embedded (KB893066)
  April Security Updates for Embedded (KB893066)
  

  Consequence

  An attacker who successfully exploits the most severe of these vulnerabilities could take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts with full user rights. An attacker who successfully exploits the most severe of these vulnerabilities would most likely cause the affected system to stop responding.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=FCDF84FF-AE44-4EB1-A58C-12D5D122FC95

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=81049A86-6F39-4A27-A643-391262785CF3

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=98D7C0DA-EA4D-4095-9047-C0086D0D29A8

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=AC019224-82BE-4263-B977-02D4DC6C9FF6

  Microsoft Windows Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F1F9A44F-D4F1-4EF8-83F7-737DF6CC292E

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=AC019224-82BE-4263-B977-02D4DC6C9FF6

  Refer to Micrsoft Security Bulletin MS05-019 for further details.

• Microsoft Internet Explorer Multiple Vulnerabilities (MS05-020)

  Severity

  Urgent 5

  Qualys ID

  100025

  Vendor Reference

  MS05-020

  CVE Reference

  CVE-2005-0553, CVE-2005-0554, CVE-2005-0555

  CVSS Scores

  Base 7.5 / Temporal 6.2

  Description

  Microsoft Security Update MS05-020 is not installed on the target. This update fixes the issues described below.

  DHTML Object Memory Corruption Vulnerability:
  A remote code execution vulnerability exists in Internet Explorer because of the way that it handles certain DHTML objects. An attacker could exploit the vulnerability by constructing a malicious Web page. This malicious Web page could allow remote code execution if a user visits a malicious Web site. An attacker who successfully exploits this vulnerability could take complete control of an affected system. (CAN-2005-0553)

  URL Parsing Memory Corruption Vulnerability:
  A remote code execution vulnerability exists in Internet Explorer because of the way that it handles certain URLs. An attacker could exploit the vulnerability by constructing a malicious Web page. This malicious Web page could potentially allow remote code execution if a user visits a malicious Web site. An attacker who successfully exploits this vulnerability could take complete control of an affected system. (CAN-2005-0554)

  Content Advisor Memory Corruption Vulnerability:
  A remote code execution vulnerability exists in Internet Explorer because of the way that it handles Content Advisor files. An attacker could exploit the vulnerability by constructing a specially crafted Content Advisor file. This malicious Content Advisor file could potentially allow remote code execution if a user visits a malicious Web site or views a malicious e-mail message and accepts the installation of the file. An attacker who successfully exploits this vulnerability could take complete control of an affected system. However, significant user interaction is required to exploit this vulnerability. (CAN-2005-0555)

  Windows XP Embedded Systems:- For additional information regarding security updates for embedded systems, refer to the following MSDN blog(s):

  April Security Updates for Embedded (KB890923)
  

  Consequence

  An attacker who successfully exploits any of these vulnerabilities could take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Internet Explorer 5.01 Service Pack 3 on Microsoft Windows 2000 Service Pack 3: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6CF45449-03D8-40B8-A4C0-09F413EE8EAB

  Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=627F8991-7717-4ADE-A5AE-169591B6AAE0

  Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows XP Service Pack 1: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=92E5A83D-9131-4B20-915A-A444C51656DC

  Internet Explorer 6 Service Pack 1 for Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium): :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=87241BC0-E1E9-4EFC-A6EC-5413119D3100

  Internet Explorer 6 for Microsoft Windows Server 2003: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=88879B7A-3F4D-40D4-ADFD-4BBD8D4D865F

  Internet Explorer 6 for Microsoft Windows Server 2003 for Itanium based Systems and Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium): :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=FF80E80F-862A-4484-BC9D-FE05F966F1F4

  Internet Explorer 6 for Microsoft Windows XP Service Pack 2: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=974F9611-6352-4F9C-B258-346C317857C5

  Refer to Micrsoft Security Bulletin MS05-020 for further details.

• Microsoft Exchange Server Remote Code Execution (MS05-021)

  Severity

  Urgent 5

  Qualys ID

  90241

  Vendor Reference

  MS05-021

  CVE Reference

  CVE-2005-0560

  CVSS Scores

  Base 7.5 / Temporal 6.2

  Description

  A remote code execution vulnerability exists in Microsoft Exchange Server. Exploitation of this issue could allow an attacker to connect to the SMTP port on an Exchange server and issue a specially-crafted command. This could result in a denial of service or allow an attacker to run malicious programs of their choice in the security context of the SMTP service.

  Consequence

  An attacker who successfully exploits this vulnerability could remotely take complete control of an affected system. The attacker could then install programs, view/edit sensitive data, and create new accounts with full system rights.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Exchange 2000 Server Service Pack 3 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2A2AF17E-2E4A-4479-8AC9-B5544EA0BD66

  Microsoft Exchange Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=97F409EB-C8D0-4C94-A67B-5945E26C9267

  Microsoft Exchange Server 2003 Service Pack 1 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=35BCE74A-E84A-4035-BF18-196368F032CC

  Refer to Microsoft Security Bulletin MS05-021 for further details.

• MSN Messenger Remote Code Excution (MS05-022)

  Severity

  Urgent 5

  Qualys ID

  38419

  Vendor Reference

  MS05-022

  CVE Reference

  CVE-2005-0562

  CVSS Scores

  Base 7.5 / Temporal 5.5

  Description

  A remote code execution vulnerability exists in MSN Messenger.

  Consequence

  By successfully exploiting this vulnerability, an attacker could take complete control of the affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  MSN Messenger 6.2 :
  http://go.microsoft.com/fwlink/?LinkId=100148

  Refer to Micrsoft Security Bulletin MS05-022 for further details.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.