Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 17 vulnerabilities that were fixed in 12 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 12 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Office XP Vulnerability Could Allow Remote Code Execution (MS05-005)

  Severity

  Urgent 5

  Qualys ID

  90225

  Vendor Reference

  MS05-005

  CVE Reference

  CVE-2004-0848

  CVSS Scores

  Base 7.5 / Temporal 5.9

  Description

  A vulnerability exists in Microsoft Office XP software that could allow remote code execution on an affected system.

  Consequence

  A remote attacker who successfully exploits this vulnerability could take complete control of the affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Office XP Software Service Pack 3 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A0115BF8-5F80-43E9-BE28-24D344600D69

  Microsoft Office XP Software Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A0115BF8-5F80-43E9-BE28-24D344600D69

  Microsoft Project 2002 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9FB0B8CC-593A-4955-9AF1-84AD2664E3AC

  Microsoft Visio 2002 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=07EB60C3-D38A-4130-BC44-6C8511ECADB9

  Microsoft Works Suite 2002 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A0115BF8-5F80-43E9-BE28-24D344600D69

  Microsoft Works Suite 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A0115BF8-5F80-43E9-BE28-24D344600D69

  Microsoft Works Suite 2004 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A0115BF8-5F80-43E9-BE28-24D344600D69

  Refer to Micrsoft Security Bulletin MS05-005 for further details.

• Microsoft ASP.NET Path Validation Vulnerability (MS05-004)

  Severity

  Serious 3

  Qualys ID

  90220

  Vendor Reference

  MS05-004

  CVE Reference

  CVE-2004-0847

  CVSS Scores

  Base 7.5 / Temporal 5.9

  Description

  A canonicalization vulnerability exists in ASP.NET that could allow an attacker to bypass the security of an ASP.NET Web site and gain unauthorized access.

  Consequence

  An attacker who successfully exploits this vulnerability could take a variety of actions, including gaining unauthorized access to parts of a Web site.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4E6D56E5-3D8D-423B-99A1-41EDF23D65BC

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EE611D27-52CF-43DB-BB97-21318C7FAA70

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3271ACD5-EE3C-4BDF-AE28-56D2DF77151E

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=33D4D33E-473F-4842-A3A8-C8266AEE8FAB

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8EC6FB8A-29EB-49CF-9DBC-1A0DC2273FF9

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyID=9bbd5617-49ae-40bf-b0fa-f9049349c6f5

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=C5E19719-000F-456A-BEAB-5BD7949F8AA2

  Microsoft .NET Framework:
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E54BE8BE-22AF-4390-86E1-25D76794D5C7

  Refer to Microsoft Security Bulletin MS05-004 for further details.

• Microsoft Windows SharePoint Services Could Allow Cross-Site Scripting and Spoofing Attacks ( MS05-006)

  Severity

  Critical 4

  Qualys ID

  90222

  Vendor Reference

  MS05-006

  CVE Reference

  CVE-2005-0049

  CVSS Scores

  Base 4.3 / Temporal 3.2

  Description

  Microsoft Windows SharePoint Services are used to create Web sites for information sharing and document collaboration. SharePoint Team Services provide similar functionality as SharePoint Services and include features available with Microsoft FrontPage Server Extensions.

  A cross-site scripting and spoofing vulnerability affects Microsoft Windows SharePoint Services and SharePoint Team Services. This vulnerability results from insufficient sanitization of user-supplied data passed through URI parameters. Specifically, data supplied through parameters is not properly validated before it is passed to a redirection query. A remote attacker may carry out a cross-site scripting attack to execute arbitrary script code in a user's browser. It is also possible to poison Web browser and intermediate proxy server caches by placing spoofed content in the caches.

  Consequence

  Reportedly, this issue may allow attackers to poison Web browser and intermediate proxy server caches as well. An attacker may leverage this aspect of the vulnerability to place spoofed content in the affected caches where it may persist. It is conjectured that this may allow an attacker to potentially carry out man in the middle type attacks.

  Solution

  Refer to Microsoft security bulletin MS05-006 for more details and instructions on installing the patch.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS05-006 Windows SharePoint Services for Windows Server 2003

• Microsoft Windows Remote Information Disclosure (MS05-007)

  Severity

  Serious 3

  Qualys ID

  90224

  Vendor Reference

  MS05-007

  CVE Reference

  CVE-2005-0051, CVE-2005-2150

  CVSS Scores

  Base 7.5 / Temporal 5.5

  Description

  There is a failure in the Microsoft Windows process which validates authentication information when a client establishes an anonymous logon by using a named pipe connection. An unauthenticated user could reach a pipe that requires authentication.

  Consequence

  An attacker who successfully exploits this vulnerability could remotely read the user names for users who have an open connection to an available shared resource.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=B8C867C2-B7CD-4E2F-90E0-169B2C7125DC

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2F68945E-EEB8-42BC-A8AD-0D3991204889

  Refer to Micrsoft Security Bulletin MS05-007 for further details.

• Microsoft Windows Shell Remote Code Execution (MS05-008)

  Severity

  Urgent 5

  Qualys ID

  90223

  Vendor Reference

  MS05-008

  CVE Reference

  CVE-2005-0053

  CVSS Scores

  Base 7.5 / Temporal 6.2

  Description

  A privilege elevation vulnerability exists in Windows due to the way that operating system handles drag-and-drop events. An attacker can exploit the vulnerability by constructing a malicious Web page. This malicious Web page could potentially allow an attacker to save a file on the user's system if the user visits a malicious Web site or views a malicious e-mail message.

  Consequence

  An attacker who successfully exploits this vulnerability could take complete control of an affected system. However, user interaction is required for successful exploitation.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=3B6A6CC1-CCE4-4462-A0D2-E88D38DEF807

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=865B5D9D-FC5B-4F91-A860-2C35A025A907

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=B6DAA99A-6E0B-477D-99E9-5237BCF57762

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9EE7FF53-20EC-4B75-A255-72DD0AB52FF3

  Microsoft Windows Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=80AA33F4-E5B0-42A6-844B-F80D6168E25E

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9EE7FF53-20EC-4B75-A255-72DD0AB52FF3

  Refer to Micrsoft Security Bulletin MS05-008 for further details.

• Windows Media Player and Windows Messenger Remote Code Execution (MS05-009)

  Severity

  Urgent 5

  Qualys ID

  90227

  Vendor Reference

  MS05-009

  CVE Reference

  CVE-2004-0597, CVE-2004-1244

  CVSS Scores

  Base 10 / Temporal 8.3

  Description

  A remote code execution vulnerability exists in Windows Media Player and Windows Messenger because they do not properly handle PNG files with excessive width or height values. An attacker could try to exploit the vulnerability by constructing a malicious PNG that allows remote code execution if an unsuspecting user visits a malicious Web site or clicks a link in a malicious email message.

  Consequence

  An attacker who successfully exploits this vulnerability could take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows Media Player 9 Series (when running on Windows 2000, Windows XP Service Pack 1 and Windows Server 2003) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A52279DC-3B6C-4720-8192-45657EDBB14F

  Microsoft Windows Messenger version 5.0 (standalone version that can be installed on all supported operating systems) :
  http://www.microsoft.com/downloads/details.aspx?FamilyID=A8D9EB73-5F8C-4B9A-940F-9157A3B3D774

  Microsoft MSN Messenger 6.1 :
  http://www.microsoft.com/downloads/details.aspx?familyid=12750556-D4D0-42D6-9F05-1FF3C799BB10

  Microsoft MSN Messenger 6.2 :
  http://www.microsoft.com/downloads/details.aspx?familyid=12750556-D4D0-42D6-9F05-1FF3C799BB10

  Refer to Micrsoft Security Bulletin MS05-009 for further details.

• Microsoft Windows License Logging Service Could Allow Code Execution (MS05-010)

  Severity

  Urgent 5

  Qualys ID

  90221

  Vendor Reference

  MS05-010

  CVE Reference

  CVE-2005-0050

  CVSS Scores

  Base 10 / Temporal 7.8

  Description

  The Microsoft Windows License Logging Service allows administrators to manage licenses for Microsoft Windows servers using the Server Client Access License (CAL) model.

  A remote buffer overflow vulnerability exists in the License Logging Service that could result in arbitrary code execution or a denial of service. Any user that is able to connect to the ports used by the service (139 and 445) can exploit this vulnerability. Arbitrary code would be executed with System privileges.

  On Windows NT 4.0 with any service pack level and Windows 2000 Service Pack 1, 2, and 3, any anonymous user that can connect to the ports could exploit this vulnerability.

  On Windows 2000 Service Pack 4 and Windows 2003 only authenticated users can exploit this vulnerability.

  This service is installed and running by default on Windows NT 4.0 servers, Windows 2000 servers, and Windows Small Business Server 2000 and 2003. The service is installed but not running by default on Windows Server 2003.

  On Windows 2003 servers, the vulnerability can only be exploited to cause a denial of service.

  Consequence

  An attacker can potentially cause denial of service and also run arbitrary code on a vulnerable system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows NT Server 4.0 Service Pack 6a :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=817FDC2D-AEE2-4FAF-908B-197B65A471F2

  Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F7B0934C-3049-4B01-956A-B116F69A667E

  Microsoft Windows 2000 Server Service Pack 3 and Microsoft Windows 2000 Server Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E9983AA2-2CEC-4B62-80D6-8E966A83A5D1

  Microsoft Windows Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=06EAF8E3-CCB7-482B-8B68-340521150113

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=EC25EC00-9C08-4555-94C7-21D5A521FDB6

  Refer to Microsoft Security Bulletin MS05-010 for further details.

• Microsoft Server Message Block Remote Code Execution (MS05-011)

  Severity

  Urgent 5

  Qualys ID

  90230

  Vendor Reference

  MS05-011

  CVE Reference

  CVE-2005-0045

  CVSS Scores

  Base 7.5 / Temporal 6.2

  Description

  A remote code execution vulnerability exists in Server Message Block (SMB) due to a failure to filter certain malformed SMB packets.

  Consequence

  An attacker who successfully exploits this vulnerability could remotely take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=656BDDA5-672B-4A6B-B192-24A2171C7355

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6DF9B2D9-B86E-4924-B677-978EC6B81B54

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E5043926-0B79-489B-8EA1-85512828C6F4

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8DA45DD0-882E-417C-A7F2-4AABAD675129

  Microsoft Windows Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=1B703115-54C0-445C-B5CE-E9A53C45B36A

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=8DA45DD0-882E-417C-A7F2-4AABAD675129

  Refer to Micrsoft Security Bulletin MS05-011 for further details.

• Microsoft Windows OLE and COM Remote Code Execution Vulnerabilities (MS05-012)

  Severity

  Urgent 5

  Qualys ID

  90228

  Vendor Reference

  MS05-012

  CVE Reference

  CVE-2005-0044, CVE-2005-0047

  CVSS Scores

  Base 7.5 / Temporal 5.9

  Description

  Microsoft Windows is reported vulnerable to OLE and COM remote code execution issues.

  A privilege elevation vulnerability exists in the way that the affected operating systems and programs access memory when they process COM structured storage files. This vulnerability could allow a logged on user to take complete control of the system. (CAN-2005-0047)

  A remote code execution vulnerability exists in OLE because of the way that it handles input validation. An attacker could exploit the vulnerability by constructing a malicious document that could potentially allow remote code execution. (CAN-2005-0044)

  Consequence

  Successful exploitation of the privilege elevation vulnerability could allow a logged on user to take complete control of the system.

  Successful exploitation of the remote code execution vulnerability could allow an attacker to take complete control of an affected system. However, user interaction is required to exploit this vulnerability on Windows 2000, Windows XP, and Windows Server 2003.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 ? :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=84B4F65E-39D5-4521-B692-051F76F2492E

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 ? :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A0E59D77-8AC1-4AC0-9572-A7E1C2E4A66A

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) ? :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=F80EABC3-6D39-4532-9178-7967626977EE

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) ? :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A2C9E842-551C-458E-BF19-1C2BA9F21A06

  Microsoft Windows Server 2003 ? :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=83B97ECE-0010-443E-9353-82FFCAF73771

  Microsoft Windows Server 2003 for Itanium based Systems ? :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=A2C9E842-551C-458E-BF19-1C2BA9F21A06

  Refer to Micrsoft Security Bulletin MS05-012 for further details.

• DHTML Editing Component ActiveX Control Remote Code Execution (MS05-013)

  Severity

  Urgent 5

  Qualys ID

  90229

  Vendor Reference

  MS05-013

  CVE Reference

  CVE-2004-1319

  CVSS Scores

  Base 5 / Temporal 4.1

  Description

  A cross-domain vulnerability that exists in the Microsoft Dynamic HTML (DHTML) Editing Component ActiveX control could allow information disclosure or remote code execution on an affected system. An attacker could exploit the vulnerability by constructing a malicious Web page that allows remote code execution if an unsuspecting user visits that page.

  Consequence

  An attacker who successfully exploits this vulnerability could take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=AEA07CBA-0E2B-4A22-91ED-1D23BB012C04

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9490E7D2-03C2-463A-B3D0-B949F5295208

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9E0247B8-240E-416C-9586-ACD5EF8578DE

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2CE98263-2AB4-4FE3-8B0B-5B3155119730

  Microsoft Windows Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E99F5BDD-8EA8-4837-960E-0D20DEA9AC4D

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=2CE98263-2AB4-4FE3-8B0B-5B3155119730

  Refer to Microsoft Security Bulletin MS05-013 for further details.

• Microsoft Internet Explorer Cumulative Update (MS05-014)

  Severity

  Urgent 5

  Qualys ID

  100024

  Vendor Reference

  MS05-014

  CVE Reference

  CVE-2005-0053, CVE-2005-0054, CVE-2005-0055, CVE-2005-0056

  CVSS Scores

  Base 7.5 / Temporal 5.9

  Description

  The target host is missing the latest Microsoft Internet Explorer cumulative patch.

  Consequence

  The latest cumulative patch fixes several security issues that can be exploited by a malicious user.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Internet Explorer 5.01 Service Pack 3 (SP3) on Windows 2000 Service Pack 3: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=34F5BCDE-4EE2-4EFD-BB60-F5A6BC5F56D1

  Internet Explorer 5.01 Service Pack 4 on Windows 2000 Service Pack 4: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4C2CBB4B-2F00-4CD6-BB98-AD14A48B53C0

  Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 3, on Microsoft Windows 2000 Service Pack 4, or on Microsoft Windows XP Service Pack 1: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E473CD05-3320-4322-B437-F3A61E62F567

  Internet Explorer 6 for Windows XP Service Pack 1 (64 Bit Edition): :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=7EAE62C0-3DA0-4BAC-B2FE-ECE89959053D

  Internet Explorer 6 for Windows Server 2003: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=4DC0FE8A-9D03-4AB8-8EAF-C85FF25CB1A2

  Internet Explorer 6 for Windows Server 2003 64 Bit Edition and Windows XP 64 Bit Edition Version 2003: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=E3C4DA1F-6FA2-4A2B-A6D9-24B599C353B3

  Internet Explorer 6 for Windows XP Service Pack 2: :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=82056EAB-8367-4B04-A11A-1002D14EB55B

  Refer to Micrsoft Security Bulletin MS05-014 for further details.

• Microsoft Hyperlink Object Library Buffer Overflow (MS05-015)

  Severity

  Urgent 5

  Qualys ID

  90231

  Vendor Reference

  MS05-015

  CVE Reference

  CVE-2005-0057

  CVSS Scores

  Base 7.5 / Temporal 5.5

  Description

  A remote code execution vulnerability exists in the Hyperlink Object Library. This problem exists because of an unchecked buffer while handling hyperlinks.

  Consequence

  If a user is logged on with administrative user rights, an attacker who successfully exploits this vulnerability could take complete control of an affected system.

  Solution

  Patch:
  Following are links for downloading patches to fix the vulnerabilities:

  Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=9DC37971-9268-4CED-85A3-2CF487EAE378

  Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=6005C5A3-AFF2-4765-B26F-BE47ED408E0B

  Microsoft Windows XP 64 Bit Edition Service Pack 1 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=84712902-1C6B-4402-9959-7A51EE319D7F

  Microsoft Windows XP 64 Bit Edition Version 2003 (Itanium) :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=558AB19E-A5A3-44A6-99A3-F0D9E7C1F714

  Microsoft Windows Server 2003 :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=68C55E18-3A3F-455B-A6C3-BB87B33CFD8E

  Microsoft Windows Server 2003 for Itanium based Systems :
  http://www.microsoft.com/downloads/details.aspx?FamilyId=558AB19E-A5A3-44A6-99A3-F0D9E7C1F714

  Refer to Micrsoft Security Bulletin MS05-015 for further details.

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.